CVE-2021-22924: debian debian_linux Improper Input Validation
Vulnerability summary
CVE-2021-22924 is a medium (CVSS 4.3) Improper Input Validation vulnerability in debian debian_linux. EPSS estimates a 6.27% chance of exploitation in the next 30 days, higher than 93.4% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 15 · Related 9Timeline
- 05-08-2021PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary depending on used file systems.The comparison also didn't include the 'issuer cert' which a transfer can setto qualify how to verify the server certificate.
CVSS metrics
6 scores · 5 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated3.7LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated3.7LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · DebianEcosystem advisory · calculated3.7LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- NVDNIST3.7LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
6.27%
Chance of exploitation in the next 30 days
Percentile
93%
Versus all other CVEs
30-day change
0.00 pp
From 6.27% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (hackerone.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-706Use of Incorrectly-Resolved Name or ReferenceThe product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
Affected systems
Siemens21 products
- ruggedcomrm_1224_lte_firmware< 7.1
- scalance_m804pb_firmware< 7.1
- scalance_m812-1_firmware< 7.1
- scalance_m816-1_firmware< 7.1
- scalance_m826-2_firmware< 7.1
Netapp4 products
Debian2 products
- curl< 7.79.1-1
- debian_linuxEOL9.0 | 10.0 | 11.0
Oracle2 products
- mysql_server≥ 5.7.0, ≤ 5.7.36 | ≥ 8.0.0, ≤ 8.0.26
- peoplesoft_enterprise_peopletools8.57 | 8.58 | 8.59
Alpine1 product
- curl< 7.78.0-r0
Fedoraproject1 product
- fedoraEOL33
Haxx1 product
- libcurl≥ 7.10.4, < 7.77.0
Splunk1 product
- universal_forwarder≥ 8.2.0, < 8.2.12 | ≥ 9.0.0, < 9.0.6 | 9.1.0
Ubuntu1 product
- curlAll versions (No fix recorded) | < 7.58.0-2ubuntu3.14 | < 7.68.0-1ubuntu2.6
9 vendors · 34 products
References
26 links
lists.debian.org/debian-lts-announce/2021/08/msg00017.htmlMailing ListX Refsource MLISTThird Party Advisory
Show all 26 references
- lists.debian.org/debian-lts-announce/2022/08/msg00017.htmlMailing ListX Refsource MLISTThird Party Advisory
