Bug 1186488 – VUL-1: CVE-2021-22897: curl: Cipher settings shared for all connections when using schannel TLS backed

Bug 1186488 - (CVE-2021-22897) VUL-1: CVE-2021-22897: curl: Cipher settings shared for all connections when using schannel TLS backed

(CVE-2021-22897)
Summary:	VUL-1: CVE-2021-22897: curl: Cipher settings shared for all connections when ...

Status:	RESOLVED INVALID

Classification:	Novell Products
Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents
Version:	unspecified
Hardware:	Other Other

Priority:	P5 - None Severity: Minor
Target Milestone:	---
Assigned To:	Pedro Monreal Gonzalez
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/300783/
Whiteboard:
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Create test case

Clone This Bug

Reported:	2021-05-27 09:14 UTC by Robert Frohl
Modified:	2021-05-27 09:14 UTC (History)
CC List:	1 user (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Robert Frohl 2021-05-27 09:14:35 UTC

rh#1964904

libcurl lets applictions specify which specific TLS ciphers to use in transfers, using the option called CURLOPT_SSL_CIPHER_LIST. The cipher selection is used for the TLS negotation when a transfer is done involving any of the TLS based transfer protocols libcurl supports, such as HTTPS, FTPS, IMAPS, POP3S, SMTPS etc. Due to a mistake in the code, the selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1964904
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-22897

Comment 1 Robert Frohl 2021-05-27 09:14:49 UTC

does not affect us, closing