CVE-2021-22898

curl 7.7 through 7.76.1 suffers from an information disclosure when the -t command line option, known as CURLOPT_TELNETOPTIONS in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.

References

Affected packages

Git / github.com/curl/curl

Affected ranges

Type: GIT
Repo: https://github.com/curl/curl
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

39ce47f219b09c380b81f89fe54ac586c8db6bde

Affected versions

Other

before_ftp_statemachine

before_urldata_rename

curl-6_5

curl-6_5_1

curl-6_5_2

curl-7_10

curl-7_10_1

curl-7_10_2

curl-7_10_3

curl-7_10_4

curl-7_10_5

curl-7_10_6

curl-7_10_7

curl-7_10_8

curl-7_11_0

curl-7_11_1

curl-7_11_2

curl-7_12_0

curl-7_12_1

curl-7_12_2

curl-7_12_3

curl-7_13_0

curl-7_13_1

curl-7_13_2

curl-7_14_0

curl-7_14_1

curl-7_15_0

curl-7_15_1

curl-7_15_2

curl-7_15_3

curl-7_15_4

curl-7_15_5

curl-7_15_6-prepipeline

curl-7_16_0

curl-7_16_1

curl-7_16_2

curl-7_16_3

curl-7_16_4

curl-7_17_0

curl-7_17_0-preldapfix

curl-7_17_1

curl-7_18_0

curl-7_18_1

curl-7_18_2

curl-7_19_0

curl-7_19_1

curl-7_19_2

curl-7_19_3

curl-7_19_4

curl-7_19_5

curl-7_19_6

curl-7_19_7

curl-7_1_1

curl-7_2

curl-7_20_0

curl-7_20_1

curl-7_21_0

curl-7_21_1

curl-7_21_2

curl-7_21_3

curl-7_21_4

curl-7_21_5

curl-7_21_6

curl-7_21_7

curl-7_22_0

curl-7_23_0

curl-7_23_1

curl-7_24_0

curl-7_25_0

curl-7_26_0

curl-7_27_0

curl-7_28_0

curl-7_28_1

curl-7_29_0

curl-7_3

curl-7_30_0

curl-7_31_0

curl-7_32_0

curl-7_33_0

curl-7_34_0

curl-7_35_0

curl-7_36_0

curl-7_37_0

curl-7_37_1

curl-7_38_0

curl-7_39_0

curl-7_40_0

curl-7_41_0

curl-7_42_0

curl-7_43_0

curl-7_44_0

curl-7_45_0

curl-7_46_0

curl-7_47_0

curl-7_47_1

curl-7_48_0

curl-7_49_0

curl-7_49_1

curl-7_4_1

curl-7_5

curl-7_50_0

curl-7_50_1

curl-7_50_2

curl-7_50_3

curl-7_51_0

curl-7_52_0

curl-7_52_1

curl-7_53_0

curl-7_53_1

curl-7_54_0

curl-7_54_1

curl-7_55_0

curl-7_55_1

curl-7_56_0

curl-7_56_1

curl-7_57_0

curl-7_58_0

curl-7_59_0

curl-7_5_2

curl-7_6

curl-7_6-pre4

curl-7_60_0

curl-7_61_0

curl-7_61_1

curl-7_62_0

curl-7_63_0

curl-7_64_0

curl-7_64_1

curl-7_65_0

curl-7_65_1

curl-7_65_2

curl-7_65_3

curl-7_66_0

curl-7_67_0

curl-7_68_0

curl-7_69_0

curl-7_69_1

curl-7_6_1

curl-7_6_1-pre1

curl-7_6_1-pre2

curl-7_6_1-pre3

curl-7_7

curl-7_7-beta1

curl-7_7-beta2

curl-7_7-beta3

curl-7_7-beta5

curl-7_70_0

curl-7_71_0

curl-7_71_1

curl-7_72_0

curl-7_73_0

curl-7_74_0

curl-7_75_0

curl-7_76_0

curl-7_76_1

curl-7_7_1

curl-7_7_2

curl-7_7_3

curl-7_7_alpha2

curl-7_8

curl-7_8-pre2

curl-7_8_1

curl-7_8_1-pre3

curl-7_9

curl-7_9_1

curl-7_9_2

curl-7_9_3

curl-7_9_3-pre1

curl-7_9_3-pre2

curl-7_9_3-pre3

curl-7_9_4

curl-7_9_5

curl-7_9_5-pre2

curl-7_9_5-pre4

curl-7_9_6

curl-7_9_7

curl-7_9_7-pre2

curl-7_9_8

curl_7_6-pre3

Database specific

vanir_signatures

[
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "61856253574400304251431398167931381325",
                "240827579168948696521027871241596897491",
                "110949695118154885913644981527849872064",
                "233170882117233154983717156358912138949"
            ]
        },
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/curl/curl/commit/39ce47f219b09c380b81f89fe54ac586c8db6bde",
        "target": {
            "file": "lib/telnet.c"
        },
        "id": "CVE-2021-22898-462dbdfc",
        "deprecated": false
    },
    {
        "digest": {
            "length": 2157.0,
            "function_hash": "278374588349917216130301655130053651655"
        },
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/curl/curl/commit/39ce47f219b09c380b81f89fe54ac586c8db6bde",
        "target": {
            "function": "suboption",
            "file": "lib/telnet.c"
        },
        "id": "CVE-2021-22898-efb2e938",
        "deprecated": false
    }
]

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-22898.json"

Git / github.com/mysql/mysql-server

Affected ranges

Type: GIT
Repo: https://github.com/mysql/mysql-server
Events: Introduced

ca94b993454c86be248fbe180db94647488114e9

Fixed

98b2ccb470de120d36bc4a623c814cdfded958ec

Affected versions

mysql-5.*

mysql-5.5.63

mysql-5.6.43

mysql-5.6.45

mysql-5.6.46

mysql-5.6.47

mysql-5.6.48

mysql-5.6.49

mysql-5.6.50

mysql-5.6.51

mysql-5.7.25

mysql-5.7.26

mysql-5.7.27

mysql-5.7.28

mysql-5.7.29

mysql-5.7.30

mysql-5.7.31

mysql-5.7.32

mysql-5.7.33

mysql-8.*

mysql-8.0.15

mysql-8.0.16

mysql-8.0.17

mysql-8.0.18

mysql-8.0.19

mysql-8.0.20

mysql-8.0.21

mysql-8.0.22

mysql-8.0.23

mysql-8.0.24

mysql-cluster-7.*

mysql-cluster-7.2.37

mysql-cluster-7.2.38

mysql-cluster-7.2.39

mysql-cluster-7.2.40

mysql-cluster-7.3.23

mysql-cluster-7.3.24

mysql-cluster-7.3.25

mysql-cluster-7.3.26

mysql-cluster-7.3.27

mysql-cluster-7.3.28

mysql-cluster-7.3.29

mysql-cluster-7.3.30

mysql-cluster-7.3.31

mysql-cluster-7.4.23

mysql-cluster-7.4.24

mysql-cluster-7.4.25

mysql-cluster-7.4.26

mysql-cluster-7.4.27

mysql-cluster-7.4.28

mysql-cluster-7.4.29

mysql-cluster-7.4.30

mysql-cluster-7.5.12

mysql-cluster-7.5.13

mysql-cluster-7.5.14

mysql-cluster-7.5.15

mysql-cluster-7.5.16

mysql-cluster-7.5.17

mysql-cluster-7.5.18

mysql-cluster-7.5.19

mysql-cluster-7.5.20

mysql-cluster-7.5.21

mysql-cluster-7.6.10

mysql-cluster-7.6.11

mysql-cluster-7.6.12

mysql-cluster-7.6.13

mysql-cluster-7.6.14

mysql-cluster-7.6.15

mysql-cluster-7.6.16

mysql-cluster-7.6.17

mysql-cluster-7.6.8

mysql-cluster-7.6.9

mysql-cluster-8.*

mysql-cluster-8.0.16

mysql-cluster-8.0.18

mysql-cluster-8.0.19

mysql-cluster-8.0.20

mysql-cluster-8.0.21

mysql-cluster-8.0.22

mysql-cluster-8.0.23

mysql-cluster-8.0.24

Database specific

vanir_signatures

[
    {
        "digest": {
            "length": 164.0,
            "function_hash": "151132652176240636847836380669942588961"
        },
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/mysql/mysql-server/commit/98b2ccb470de120d36bc4a623c814cdfded958ec",
        "target": {
            "function": "Item_ntile::fix_fields",
            "file": "sql/item_sum.cc"
        },
        "id": "CVE-2021-22898-3a3afa13",
        "deprecated": false
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "77377636987516944716339593611926856803",
                "142305612386154007679493547611883749558",
                "28963515312630878181069270734519432484",
                "189136154787345778069113967453357263064",
                "279825870249106404218276981844202046255",
                "49834063100662448344239531338010457862",
                "305324677266273514331621360994794102163",
                "291539385034554585704690285934398658292",
                "236290264454280366434563539014838479614",
                "141317470226054596320765560831766974514",
                "293246036016278744162797714460506529443",
                "122395028490668685882586271524119445319",
                "284458543644346001938693822336726309792",
                "235525345452044799367912843591411764217",
                "165750678219403994129886011648698991884"
            ]
        },
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/mysql/mysql-server/commit/98b2ccb470de120d36bc4a623c814cdfded958ec",
        "target": {
            "file": "sql/item_sum.h"
        },
        "id": "CVE-2021-22898-b466ba2c",
        "deprecated": false
    },
    {
        "digest": {
            "length": 2099.0,
            "function_hash": "289288981748901423130195206259685444645"
        },
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/mysql/mysql-server/commit/98b2ccb470de120d36bc4a623c814cdfded958ec",
        "target": {
            "function": "Item_func_group_concat::fix_fields",
            "file": "sql/item_sum.cc"
        },
        "id": "CVE-2021-22898-c1e56b4a",
        "deprecated": false
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "128532828239806081815173253903495399937",
                "185178342391912730906413602950301399845",
                "97073121848381340882801958057414112130",
                "21787205664934285124213972897648826910",
                "210360094889580693759307439820673316785",
                "91968359554667373632799823213263885280",
                "204786958800992693528587719972879106019",
                "336835840659383473680709084941686065983",
                "231712879563153787737540134928862224841",
                "323967078698100139790231535302074881119",
                "60799587189103250276527900071006429076",
                "141679927460555707293407627171615006659",
                "319137299000429162692642899254402106810"
            ]
        },
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/mysql/mysql-server/commit/98b2ccb470de120d36bc4a623c814cdfded958ec",
        "target": {
            "file": "sql/item_sum.cc"
        },
        "id": "CVE-2021-22898-e0665040",
        "deprecated": false
    }
]

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-22898.json"