Vulnerability Details : CVE-2021-22926

libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the `CURLOPT_SSLCERT` option (`--cert` with the command line tool).When libcurl is built to use the macOS native TLS library Secure Transport, an application can ask for the client certificate by name or with a file name - using the same option. If the name exists as a file, it will be used instead of by name.If the appliction runs with a current working directory that is writable by other users (like `/tmp`), a malicious user can create a file name with the same name as the app wants to use by name, and thereby trick the application to use the file based cert instead of the one referred to by name making libcurl send the wrong client certificate in the TLS connection handshake.
Publish Date : 2021-08-05 Last Update Date : 2023-01-05

Collapse All Expand All Select Select&Copy	Scroll To Vendor Statements(0) Additional Vendor Data(0) OVAL Definitions(0) Vulnerable Products(0) # Of Vulns By Products References(0) Metasploit Modules(0)	Comments View User Comments Add Comment	External Links Secunia Advisories XForce Advisories Vulnerability Details at NVD Vulnerability Details at Mitre Nessus Plugins Linux Kernel Git Repository First CVSS Guide
Search Twitter Search YouTube Search Google

- CVSS Scores & Vulnerability Types

CVSS Score	5.0
Confidentiality Impact	None (There is no impact to the confidentiality of the system.)
Integrity Impact	None (There is no impact to the integrity of the system)
Availability Impact	Partial (There is reduced performance or interruptions in resource availability.)
Access Complexity	Low (Specialized access conditions or extenuating circumstances do not exist. Very little knowledge or skill is required to exploit. )
Authentication	Not required (Authentication is not required to exploit the vulnerability.)
Gained Access	None
Vulnerability Type(s)
CWE ID	295

- Products Affected By CVE-2021-22926

#	Product Type	Vendor	Product	Version	Update	Edition	Language
1	Application	Haxx	Curl	*	*	*	*	Version Details Vulnerabilities
2	Application	Netapp	Active Iq Unified Manager	-	*	*	*	Version Details Vulnerabilities
3	Application	Netapp	Active Iq Unified Manager	-	*	*	*	Version Details Vulnerabilities
4	Application	Netapp	Clustered Data Ontap	-	*	*	*	Version Details Vulnerabilities
5	Application	Netapp	Hci Management Node	-	*	*	*	Version Details Vulnerabilities
6	Application	Netapp	Oncommand Insight	-	*	*	*	Version Details Vulnerabilities
7	Application	Netapp	Oncommand Workflow Automation	-	*	*	*	Version Details Vulnerabilities
8	Application	Netapp	Snapcenter	-	*	*	*	Version Details Vulnerabilities
9	Application	Netapp	Solidfire	-	*	*	*	Version Details Vulnerabilities
10	Application	Oracle	Mysql Server	*	*	*	*	Version Details Vulnerabilities
11	Application	Oracle	Peoplesoft Enterprise Peopletools	8.57	*	*	*	Version Details Vulnerabilities
12	Application	Oracle	Peoplesoft Enterprise Peopletools	8.58	*	*	*	Version Details Vulnerabilities
13	Application	Oracle	Peoplesoft Enterprise Peopletools	8.59	*	*	*	Version Details Vulnerabilities
14	Application	Siemens	Sinec Infrastructure Network Services	*	*	*	*	Version Details Vulnerabilities

- Number Of Affected Versions By Product

Vendor	Product	Vulnerable Versions
Haxx	Curl	1
Netapp	Active Iq Unified Manager	2
Netapp	Clustered Data Ontap	1
Netapp	Hci Management Node	1
Netapp	Oncommand Insight	1
Netapp	Oncommand Workflow Automation	1
Netapp	Snapcenter	1
Netapp	Solidfire	1
Oracle	Mysql Server	1
Oracle	Peoplesoft Enterprise Peopletools	3
Siemens	Sinec Infrastructure Network Services	1

- References For CVE-2021-22926

https://www.oracle.com/security-alerts/cpujan2022.html

https://security.netapp.com/advisory/ntap-20211022-0003/ CONFIRM

https://security.netapp.com/advisory/ntap-20210902-0003/ CONFIRM

https://lists.apache.org/thread.html/[email protected]%3Cdev.kafka.apache.org%3E
MLIST [kafka-dev] 20210831 Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image

https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf CONFIRM

https://lists.apache.org/thread.html/[email protected]%3Cusers.kafka.apache.org%3E
MLIST [kafka-users] 20210831 Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image

https://www.oracle.com/security-alerts/cpuoct2021.html

https://lists.apache.org/thread.html/[email protected]%3Cusers.kafka.apache.org%3E
MLIST [kafka-users] 20210901 Re: [EXTERNAL] Re: Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image

https://security.gentoo.org/glsa/202212-01
GENTOO GLSA-202212-01

https://lists.apache.org/thread.html/[email protected]%3Cdev.kafka.apache.org%3E
MLIST [kafka-dev] 20210901 Re: [EXTERNAL] Re: Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image

https://hackerone.com/reports/1234760

- Vulnerability Conditions

Vulnerability is valid if product versions listed below are used 0
Siemens Sinec Infrastructure Network Services * * * * Oracle Mysql Server * * * * Oracle Peoplesoft Enterprise Peopletools 8.59 * * * Oracle Peoplesoft Enterprise Peopletools 8.58 * * * Oracle Peoplesoft Enterprise Peopletools 8.57 * * * Netapp Active Iq Unified Manager * * * Netapp Active Iq Unified Manager * * * Netapp Hci Management Node * * * Netapp Solidfire * * * Netapp Clustered Data Ontap * * * Netapp Oncommand Insight * * * Netapp Oncommand Workflow Automation * * * Netapp Snapcenter * * * Haxx Curl * * * *	Netapp H300e * * * Netapp H300e Firmware * * * Netapp H300s * * * Netapp H300s Firmware * * * Netapp H410s * * * Netapp H410s Firmware * * * Netapp H500e * * * Netapp H500e Firmware * * * Netapp H500s * * * Netapp H500s Firmware * * * Netapp H700e * * * Netapp H700e Firmware * * * Netapp H700s * * * Netapp H700s Firmware * * *
Vulnerability is valid if product versions listed below are used 0
Siemens Sinec Infrastructure Network Services * * * * Oracle Mysql Server * * * * Oracle Peoplesoft Enterprise Peopletools 8.59 * * * Oracle Peoplesoft Enterprise Peopletools 8.58 * * * Oracle Peoplesoft Enterprise Peopletools 8.57 * * * Netapp Active Iq Unified Manager * * * Netapp Active Iq Unified Manager * * * Netapp Hci Management Node * * * Netapp Solidfire * * * Netapp Clustered Data Ontap * * * Netapp Oncommand Insight * * * Netapp Oncommand Workflow Automation * * * Netapp Snapcenter * * * Haxx Curl * * * *	Netapp H300e * * * Netapp H300e Firmware * * * Netapp H300s * * * Netapp H300s Firmware * * * Netapp H410s * * * Netapp H410s Firmware * * * Netapp H500e * * * Netapp H500e Firmware * * * Netapp H500s * * * Netapp H500s Firmware * * * Netapp H700e * * * Netapp H700e Firmware * * * Netapp H700s * * * Netapp H700s Firmware * * *
Vulnerability is valid if product versions listed below are used 0
Siemens Sinec Infrastructure Network Services * * * * Oracle Mysql Server * * * * Oracle Peoplesoft Enterprise Peopletools 8.59 * * * Oracle Peoplesoft Enterprise Peopletools 8.58 * * * Oracle Peoplesoft Enterprise Peopletools 8.57 * * * Netapp Active Iq Unified Manager * * * Netapp Active Iq Unified Manager * * * Netapp Hci Management Node * * * Netapp Solidfire * * * Netapp Clustered Data Ontap * * * Netapp Oncommand Insight * * * Netapp Oncommand Workflow Automation * * * Netapp Snapcenter * * * Haxx Curl * * * *	Netapp H300e * * * Netapp H300e Firmware * * * Netapp H300s * * * Netapp H300s Firmware * * * Netapp H410s * * * Netapp H410s Firmware * * * Netapp H500e * * * Netapp H500e Firmware * * * Netapp H500s * * * Netapp H500s Firmware * * * Netapp H700e * * * Netapp H700e Firmware * * * Netapp H700s * * * Netapp H700s Firmware * * *
Vulnerability is valid if product versions listed below are used 0
Siemens Sinec Infrastructure Network Services * * * * Oracle Mysql Server * * * * Oracle Peoplesoft Enterprise Peopletools 8.59 * * * Oracle Peoplesoft Enterprise Peopletools 8.58 * * * Oracle Peoplesoft Enterprise Peopletools 8.57 * * * Netapp Active Iq Unified Manager * * * Netapp Active Iq Unified Manager * * * Netapp Hci Management Node * * * Netapp Solidfire * * * Netapp Clustered Data Ontap * * * Netapp Oncommand Insight * * * Netapp Oncommand Workflow Automation * * * Netapp Snapcenter * * * Haxx Curl * * * *	Netapp H300e * * * Netapp H300e Firmware * * * Netapp H300s * * * Netapp H300s Firmware * * * Netapp H410s * * * Netapp H410s Firmware * * * Netapp H500e * * * Netapp H500e Firmware * * * Netapp H500s * * * Netapp H500s Firmware * * * Netapp H700e * * * Netapp H700e Firmware * * * Netapp H700s * * * Netapp H700s Firmware * * *
Vulnerability is valid if product versions listed below are used 0
Siemens Sinec Infrastructure Network Services * * * * Oracle Mysql Server * * * * Oracle Peoplesoft Enterprise Peopletools 8.59 * * * Oracle Peoplesoft Enterprise Peopletools 8.58 * * * Oracle Peoplesoft Enterprise Peopletools 8.57 * * * Netapp Active Iq Unified Manager * * * Netapp Active Iq Unified Manager * * * Netapp Hci Management Node * * * Netapp Solidfire * * * Netapp Clustered Data Ontap * * * Netapp Oncommand Insight * * * Netapp Oncommand Workflow Automation * * * Netapp Snapcenter * * * Haxx Curl * * * *	Netapp H300e * * * Netapp H300e Firmware * * * Netapp H300s * * * Netapp H300s Firmware * * * Netapp H410s * * * Netapp H410s Firmware * * * Netapp H500e * * * Netapp H500e Firmware * * * Netapp H500s * * * Netapp H500s Firmware * * * Netapp H700e * * * Netapp H700e Firmware * * * Netapp H700s * * * Netapp H700s Firmware * * *
Vulnerability is valid if product versions listed below are used 0
Siemens Sinec Infrastructure Network Services * * * * Oracle Mysql Server * * * * Oracle Peoplesoft Enterprise Peopletools 8.59 * * * Oracle Peoplesoft Enterprise Peopletools 8.58 * * * Oracle Peoplesoft Enterprise Peopletools 8.57 * * * Netapp Active Iq Unified Manager * * * Netapp Active Iq Unified Manager * * * Netapp Hci Management Node * * * Netapp Solidfire * * * Netapp Clustered Data Ontap * * * Netapp Oncommand Insight * * * Netapp Oncommand Workflow Automation * * * Netapp Snapcenter * * * Haxx Curl * * * *	Netapp H300e * * * Netapp H300e Firmware * * * Netapp H300s * * * Netapp H300s Firmware * * * Netapp H410s * * * Netapp H410s Firmware * * * Netapp H500e * * * Netapp H500e Firmware * * * Netapp H500s * * * Netapp H500s Firmware * * * Netapp H700e * * * Netapp H700e Firmware * * * Netapp H700s * * * Netapp H700s Firmware * * *
Vulnerability is valid if product versions listed below are used 0
Siemens Sinec Infrastructure Network Services * * * * Oracle Mysql Server * * * * Oracle Peoplesoft Enterprise Peopletools 8.59 * * * Oracle Peoplesoft Enterprise Peopletools 8.58 * * * Oracle Peoplesoft Enterprise Peopletools 8.57 * * * Netapp Active Iq Unified Manager * * * Netapp Active Iq Unified Manager * * * Netapp Hci Management Node * * * Netapp Solidfire * * * Netapp Clustered Data Ontap * * * Netapp Oncommand Insight * * * Netapp Oncommand Workflow Automation * * * Netapp Snapcenter * * * Haxx Curl * * * *	Netapp H300e * * * Netapp H300e Firmware * * * Netapp H300s * * * Netapp H300s Firmware * * * Netapp H410s * * * Netapp H410s Firmware * * * Netapp H500e * * * Netapp H500e Firmware * * * Netapp H500s * * * Netapp H500s Firmware * * * Netapp H700e * * * Netapp H700e Firmware * * * Netapp H700s * * * Netapp H700s Firmware * * *
Vulnerability is valid if product versions listed below are used 0
Siemens Sinec Infrastructure Network Services * * * * Oracle Mysql Server * * * * Oracle Peoplesoft Enterprise Peopletools 8.59 * * * Oracle Peoplesoft Enterprise Peopletools 8.58 * * * Oracle Peoplesoft Enterprise Peopletools 8.57 * * * Netapp Active Iq Unified Manager * * * Netapp Active Iq Unified Manager * * * Netapp Hci Management Node * * * Netapp Solidfire * * * Netapp Clustered Data Ontap * * * Netapp Oncommand Insight * * * Netapp Oncommand Workflow Automation * * * Netapp Snapcenter * * * Haxx Curl * * * *	Netapp H300e * * * Netapp H300e Firmware * * * Netapp H300s * * * Netapp H300s Firmware * * * Netapp H410s * * * Netapp H410s Firmware * * * Netapp H500e * * * Netapp H500e Firmware * * * Netapp H500s * * * Netapp H500s Firmware * * * Netapp H700e * * * Netapp H700e Firmware * * * Netapp H700s * * * Netapp H700s Firmware * * *
Vulnerability is valid if product versions listed below are used 0
Siemens Sinec Infrastructure Network Services * * * * Oracle Mysql Server * * * * Oracle Peoplesoft Enterprise Peopletools 8.59 * * * Oracle Peoplesoft Enterprise Peopletools 8.58 * * * Oracle Peoplesoft Enterprise Peopletools 8.57 * * * Netapp Active Iq Unified Manager * * * Netapp Active Iq Unified Manager * * * Netapp Hci Management Node * * * Netapp Solidfire * * * Netapp Clustered Data Ontap * * * Netapp Oncommand Insight * * * Netapp Oncommand Workflow Automation * * * Netapp Snapcenter * * * Haxx Curl * * * *	Netapp H300e * * * Netapp H300e Firmware * * * Netapp H300s * * * Netapp H300s Firmware * * * Netapp H410s * * * Netapp H410s Firmware * * * Netapp H500e * * * Netapp H500e Firmware * * * Netapp H500s * * * Netapp H500s Firmware * * * Netapp H700e * * * Netapp H700e Firmware * * * Netapp H700s * * * Netapp H700s Firmware * * *
Vulnerability is valid if product versions listed below are used 0
Siemens Sinec Infrastructure Network Services * * * * Oracle Mysql Server * * * * Oracle Peoplesoft Enterprise Peopletools 8.59 * * * Oracle Peoplesoft Enterprise Peopletools 8.58 * * * Oracle Peoplesoft Enterprise Peopletools 8.57 * * * Netapp Active Iq Unified Manager * * * Netapp Active Iq Unified Manager * * * Netapp Hci Management Node * * * Netapp Solidfire * * * Netapp Clustered Data Ontap * * * Netapp Oncommand Insight * * * Netapp Oncommand Workflow Automation * * * Netapp Snapcenter * * * Haxx Curl * * * *	Netapp H300e * * * Netapp H300e Firmware * * * Netapp H300s * * * Netapp H300s Firmware * * * Netapp H410s * * * Netapp H410s Firmware * * * Netapp H500e * * * Netapp H500e Firmware * * * Netapp H500s * * * Netapp H500s Firmware * * * Netapp H700e * * * Netapp H700e Firmware * * * Netapp H700s * * * Netapp H700s Firmware * * *
Vulnerability is valid if product versions listed below are used 0
Siemens Sinec Infrastructure Network Services * * * * Oracle Mysql Server * * * * Oracle Peoplesoft Enterprise Peopletools 8.59 * * * Oracle Peoplesoft Enterprise Peopletools 8.58 * * * Oracle Peoplesoft Enterprise Peopletools 8.57 * * * Netapp Active Iq Unified Manager * * * Netapp Active Iq Unified Manager * * * Netapp Hci Management Node * * * Netapp Solidfire * * * Netapp Clustered Data Ontap * * * Netapp Oncommand Insight * * * Netapp Oncommand Workflow Automation * * * Netapp Snapcenter * * * Haxx Curl * * * *	Netapp H300e * * * Netapp H300e Firmware * * * Netapp H300s * * * Netapp H300s Firmware * * * Netapp H410s * * * Netapp H410s Firmware * * * Netapp H500e * * * Netapp H500e Firmware * * * Netapp H500s * * * Netapp H500s Firmware * * * Netapp H700e * * * Netapp H700e Firmware * * * Netapp H700s * * * Netapp H700s Firmware * * *

- Metasploit Modules Related To CVE-2021-22926

There are not any metasploit modules related to this CVE entry (Please visit www.metasploit.com for more information)