UpHeron
All vulnerabilities

Servers and applications

CVE-2021-22897

curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets…

Severity
Medium 5.3
Published
11 Jun 2021
Last changed
14 Oct 2026
Added to UpHeron
21 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
curlServers and applications · cpe:a:haxx:curl
  • From 7.61.0 up to 7.76.1
MySQLServers and applications · cpe:a:oracle:mysql_server
  • Every version up to 5.7.34
  • From 8.0.0 up to 8.0.25

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-22897
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-22897