curl 7.7 through 7.76.1 suffers from an information disclosure when the -t command line option, known as CURLOPT_TELNETOPTIONS in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.
[
{
"id": "CVE-2021-22898-462dbdfc",
"signature_version": "v1",
"digest": {
"line_hashes": [
"61856253574400304251431398167931381325",
"240827579168948696521027871241596897491",
"110949695118154885913644981527849872064",
"233170882117233154983717156358912138949"
],
"threshold": 0.9
},
"target": {
"file": "lib/telnet.c"
},
"source": "https://github.com/curl/curl/commit/39ce47f219b09c380b81f89fe54ac586c8db6bde",
"signature_type": "Line",
"deprecated": false
},
{
"id": "CVE-2021-22898-efb2e938",
"signature_version": "v1",
"digest": {
"length": 2157.0,
"function_hash": "278374588349917216130301655130053651655"
},
"target": {
"file": "lib/telnet.c",
"function": "suboption"
},
"source": "https://github.com/curl/curl/commit/39ce47f219b09c380b81f89fe54ac586c8db6bde",
"signature_type": "Function",
"deprecated": false
}
]