Vulnerability in libcurl in Alpine Linux's curl package (CVE-2021-22924)
Summary
CVE-2021-22924: libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into ac... Affects curl across 4 version ranges.
< 7.78.0-r0
< 30077692dc6b4724f08bc5ef2e85c955f8cb305d
>= bfd00ac2ed315d8a309483eafb022e3cbe424326, < 6b951a6928811507d493303b2878e848c077b471
< e77196783af6ed1feac594aa467dbe6f4a4c9735
Fixed in 7.78.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The curl package in Alpine Linux is a command-line tool and library for transferring data with URLs. It supports various protocols, including HTTP, HTTPS, FTP, and more. The package is widely used in software applications for network communication and data transfer. However, a vulnerability has been discovered in the libcurl library used by the curl package, which can lead to the reuse of wrong connections due to errors in the logic of the connection pool. This vulnerability affects versions of the curl package in Alpine Linux up to version 7.78.0-r0.
Vulnerability Detail
The vulnerability (CVE-2021-22924) in the libcurl library used by the curl package arises from errors in the logic of the connection pool. When reusing connections, the library did not properly consider the 'issuercert' and performed a case-insensitive comparison of file paths. This can result in libcurl reusing incorrect connections, potentially leading to security issues. File paths can be case-sensitive on some systems, and the comparison also failed to include the 'issuer cert' set by a transfer to verify the server certificate.
How To Fix
Minimum fixed version
7.78.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by updating the curl package to the fixed version.
Conclusion
In conclusion, the libcurl library used by the curl package in Alpine Linux is vulnerable to the reuse of wrong connections due to errors in the connection pool logic. It is crucial to update the curl package to version 7.78.0-r0 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for curl →
FAQ
This vulnerability can potentially lead to the reuse of wrong connections in the libcurl library, which may result in security issues or incorrect data transfer.
Versions of the curl package in Alpine Linux up to version 7.78.0-r0 are affected by this vulnerability.
No, file systems can vary in their case sensitivity. While some file systems are case-sensitive, others are not. It is important to consider the specific file system being used.
Yes, the CVSS score for this vulnerability is 3.7.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for curl.
