CVE-2021-22922 - log back

CVE-2021-22922 edited at 21 Jul 2021 09:47:16
Description
- When curl before version 7.78.0 is instructed to download content using the metalink feature, the contents is verified against a hash provided in the metalink XML file.
+ A security issue has been found in curl before version 7.78.0. When curl is instructed to download content using the metalink feature, the contents is verified against a hash provided in the metalink XML file. The metalink XML file points out to the client how to get the same content from a set of different URLs, potentially hosted by different servers and the client can then download the file from one or several of them in a serial or parallel manner.
- The metalink XML file points out to the client how to get the same content from a set of different URLs, potentially hosted by different servers and the client can then download the file from one or several of them in a serial or parallel manner.
-
- If one of the servers hosting the contents has been breached and the contents of the specific file on that server is replaced with a modified payload, curl should detect this when the hash of the file mismatches after a completed download. It should remove the contents and instead try getting the contents from another URL. This is not done, and instead such a hash mismatch is only mentioned in text and the potentially malicious content is kept in the file on disk.
+ If one of the servers hosting the contents has been breached and the contents of the specific file on that server is replaced with a modified payload, curl should detect this when the hash of the file mismatches after a completed download. It should remove the contents and instead try getting the contents from another URL. This is not done, and instead such a hash mismatch is only mentioned in text and the potentially malicious content is kept in the file on disk. There's a risk the user doesn't notice the message and instead assumes the file is fine.
-
- There's a risk the user doesn't notice the message and instead assumes the file is fine.
This flaw exists only in the curl tool. libcurl is not affected.
Notes
+ Workaround
+ ==========
+
+ The issue can be mitigated by making sure not to use metalink with curl.
CVE-2021-22922 edited at 21 Jul 2021 09:10:03
Severity
- Unknown
+ Medium
Remote
- Unknown
+ Remote
Type
- Unknown
+ Insufficient validation
Description
+ When curl before version 7.78.0 is instructed to download content using the metalink feature, the contents is verified against a hash provided in the metalink XML file.
+
+ The metalink XML file points out to the client how to get the same content from a set of different URLs, potentially hosted by different servers and the client can then download the file from one or several of them in a serial or parallel manner.
+
+ If one of the servers hosting the contents has been breached and the contents of the specific file on that server is replaced with a modified payload, curl should detect this when the hash of the file mismatches after a completed download. It should remove the contents and instead try getting the contents from another URL. This is not done, and instead such a hash mismatch is only mentioned in text and the potentially malicious content is kept in the file on disk.
+
+ There's a risk the user doesn't notice the message and instead assumes the file is fine.
+
+ This flaw exists only in the curl tool. libcurl is not affected.
References
+ https://curl.se/docs/CVE-2021-22922.html
+ https://github.com/curl/curl/pull/7176
+ https://github.com/curl/curl/commit/265b14d6b37c4298bd5556fabcbc37d36f911693
Notes
CVE-2021-22922 created at 21 Jul 2021 09:06:34