{"id":"CVE-2021-22897","details":"curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single \"static\" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.","aliases":["CURL-CVE-2021-22897"],"modified":"2026-07-09T01:06:07.938891Z","published":"2021-06-11T16:15:10.963Z","database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:oracle:essbase:*:*:*:*:*:*:*:*"],"extracted_events":[{"fixed":"11.1.2.4.047"},{"introduced":"21.0"},{"fixed":"21.3"}],"source":"CPE_RANGE","vendor_product":"oracle:essbase"},{"extracted_events":[{"fixed":"1.0.1.1"}],"source":"CPE_RANGE","vendor_product":"siemens:sinec_infrastructure_network_services","cpes":["cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:*"]},{"cpes":["cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.2.0"},{"fixed":"8.2.12"},{"introduced":"9.0.0"},{"fixed":"9.0.6"}],"source":"CPE_RANGE","vendor_product":"splunk:universal_forwarder"},{"source":"CPE_STRING","vendor_product":"oracle:communications_cloud_native_core_binding_support_function","cpes":["cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.11.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"1.11.0"},{"last_affected":"1.11.0"}]},{"cpes":["cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"1.10.0"},{"last_affected":"1.10.0"}],"source":"CPE_STRING","vendor_product":"oracle:communications_cloud_native_core_network_function_cloud_native_environment"},{"source":"CPE_STRING","vendor_product":"oracle:communications_cloud_native_core_network_repository_function","cpes":["cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"1.15.0"},{"last_affected":"1.15.0"},{"introduced":"1.15.1"},{"last_affected":"1.15.1"}]},{"cpes":["cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"1.8.0"},{"last_affected":"1.8.0"}],"source":"CPE_STRING","vendor_product":"oracle:communications_cloud_native_core_network_slice_selection_function"},{"cpes":["cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.15.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"1.15.0"},{"last_affected":"1.15.0"}],"source":"CPE_STRING","vendor_product":"oracle:communications_cloud_native_core_service_communication_proxy"},{"vendor_product":"splunk:universal_forwarder","cpes":["cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"9.1.0"},{"last_affected":"9.1.0"}],"source":"CPE_STRING"}]},"references":[{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20210727-0007/"},{"type":"REPORT","url":"https://hackerone.com/reports/1172857"},{"type":"FIX","url":"https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"},{"type":"FIX","url":"https://curl.se/docs/CVE-2021-22897.html"},{"type":"FIX","url":"https://github.com/curl/curl/commit/bbb71507b7bab52002f9b1e0880bed6a32834511"},{"type":"FIX","url":"https://www.oracle.com//security-alerts/cpujul2021.html"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpuapr2022.html"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpujan2022.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/curl/curl","events":[{"introduced":"eb8138405a3f747f2c236464932f72e918946f68"},{"last_affected":"566b74a0e19b9aa610f4931e5bfd339bcf8e9147"},{"fixed":"bbb71507b7bab52002f9b1e0880bed6a32834511"}],"database_specific":{"cpe":"cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"7.61.0"},{"last_affected":"7.76.1"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["curl-7_76_1","curl-7_76_0","curl-7_75_0","curl-7_74_0","curl-7_73_0","curl-7_72_0","curl-7_71_1","curl-7_71_0","curl-7_70_0","curl-7_69_1","curl-7_69_0","curl-7_68_0","curl-7_67_0","curl-7_66_0","curl-7_65_3","curl-7_65_2","curl-7_65_1","curl-7_65_0","curl-7_64_1","curl-7_64_0","curl-7_63_0","curl-7_62_0","curl-7_61_1","curl-7_61_0"],"database_specific":{"vanir_signatures":[{"id":"CVE-2021-22897-462e72f1","signature_type":"Line","signature_version":"v1","source":"https://github.com/curl/curl/commit/bbb71507b7bab52002f9b1e0880bed6a32834511","target":{"file":"lib/vtls/schannel.c"},"deprecated":false,"digest":{"line_hashes":["169306282263403152476778100550579197303","297501274346842746936104394958035664195","115226342142473284132899468397361420315","234734752945961461342272917723384093426","295386562829775930098639946838584527244","219517661826067509758353138597803787494","244949559378790381198359763585636363260","332559676467627573058079295969579883439","172944519042723511467055631002959388061","49891809641561640485570718961026384269","303945483550590176791034946765591014847","160380589874126636249932610610053765267","202261837233141056431919104544500820999"],"threshold":0.9}},{"source":"https://github.com/curl/curl/commit/bbb71507b7bab52002f9b1e0880bed6a32834511","target":{"file":"lib/vtls/schannel.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["144288989636727895116566759813531481869","310223903940348029157260322620209786472","305687057856332765216788005169622682063","325657448106323421990448296138158547936","292286319081006362423274139499724779986","39604824998280807468150180221600407666","57176848086045237311152580885468675039"]},"id":"CVE-2021-22897-66d13eee","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"211186878913764398743821657885986770610","length":14322},"id":"CVE-2021-22897-8c49663e","signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl/commit/bbb71507b7bab52002f9b1e0880bed6a32834511","target":{"file":"lib/vtls/schannel.c","function":"schannel_connect_step1"}},{"id":"CVE-2021-22897-ff708dce","signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl/commit/bbb71507b7bab52002f9b1e0880bed6a32834511","target":{"file":"lib/vtls/schannel.c","function":"set_ssl_ciphers"},"deprecated":false,"digest":{"function_hash":"36431407875438539121636832984401189544","length":676}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-22897.json","vanir_signatures_modified":"2026-07-09T01:06:07Z"}},{"ranges":[{"type":"GIT","repo":"https://github.com/mysql/mysql-server","events":[{"introduced":"0"},{"last_affected":"a9b0c712de3509d8d08d3ba385d41a4df6348775"},{"introduced":"270fd3411e3d671a73ed9725940a30080f59ce6d"},{"last_affected":"98b2ccb470de120d36bc4a623c814cdfded958ec"}],"database_specific":{"cpe":"cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"5.7.34"},{"introduced":"8.0.0"},{"last_affected":"8.0.25"}],"source":"CPE_RANGE"}}],"versions":["mysql-cluster-8.0.25","mysql-8.0.25","mysql-cluster-8.0.24","mysql-8.0.24","mysql-5.7.34","mysql-5.7.32","mysql-5.7.31","mysql-5.1.4","mysql-4.0.4","mysql-4.0.2","mysql-3.23.36","mysql-3.23.33","mysql-3.23.32","mysql-3.23.31","mysql-3.23.30-gamma","mysql-3.23.28-gamma","mysql-3.23.22-beta"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-22897.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}