CVE-2021-22925: apple mac_os_x

Vulnerability summary

CVE-2021-22925 is a medium (CVSS 5.3) vulnerability in apple mac_os_x. EPSS estimates a 5.37% chance of exploitation in the next 30 days, higher than 92.5% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 05-08-2021
   PublishedVulnerability first disclosed.
2. 14-10-2026
   Last modifiedVulnerability information updated.

Description

curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending `NEW_ENV` variables, libcurlcould be made to pass on uninitialized data from a stack based buffer to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing the string provided by the application.

• CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
• CWE-908Use of Uninitialized ResourceThe product uses or accesses a resource that has not been initialized.