CVE-2021-22923
Metalink download sends credentials
Project curl Security Advisory, July 21th 2021 - Permalink
VULNERABILITY
When curl is instructed to get content using the Metalink feature, and a user name and password are used to download the Metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl downloads or tries to download the contents from. Often contrary to the user's expectations and intentions and without telling the user it happened.
INFO
This flaw exists only in the curl tool. libcurl is not affected.
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2021-22923 to this issue.
CWE-522: Insufficiently Protected Credentials
Severity: Medium
AFFECTED VERSIONS
- Affected versions: curl 7.27.0 to and including 7.77.0
- Not affected versions: curl < 7.27.0 and curl >= 7.78.0
- Introduced-in: https://github.com/curl/curl/commit/b5fdbe848bc3d
SOLUTION
curl has completely removed the Metalink feature as of 7.78.0. No fix for this flaw is produced by the curl project.
The fix for earlier versions is to rebuild curl with the Metalink support switched off!
RECOMMENDATIONS
A - Upgrade curl to version 7.78.0
B - Make sure you do not use Metalink with curl
C - Disable Metalink in your build
TIMELINE
This issue was reported to the curl project on May 30, 2021.
This advisory was posted on Jul 21, 2021.
CREDITS
- Reported-by: Harry Sintonen
- Patched-by: Daniel Stenberg
Thanks a lot!