CVE-2021-22923: Fedoraproject Fedora

Medium severity, CVSS 5.3. EPSS: 1.9% chance of exploitation in the next 30 days.

When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user's expectations and intentions and without telling the user it happened.

Affected products

• Fedoraproject Fedora: version 33 only
• Haxx Curl: from 7.27.0, before 7.78.0 (fixed in 7.78.0)
• Netapp Cloud Backup: affected versions not specified
• Netapp Clustered Data Ontap: affected versions not specified
• Netapp h300e Firmware: affected versions not specified
• Netapp h300s Firmware: affected versions not specified
• Netapp h410s Firmware: affected versions not specified
• Netapp h500e Firmware: affected versions not specified
• Netapp h500s Firmware: affected versions not specified
• Netapp h700e Firmware: affected versions not specified
• Netapp h700s Firmware: affected versions not specified
• Netapp Hci Management Node: affected versions not specified
• Netapp Solidfire: affected versions not specified
• Oracle MySQL Server: from 5.7.0, up to and including 5.7.35; from 8.0.0, up to and including 8.0.26
• Siemens Sinec Infrastructure Network Services: before 1.0.1.1 (fixed in 1.0.1.1)
• Splunk Universal Forwarder: from 8.2.0, before 8.2.12 (fixed in 8.2.12); from 9.0.0, before 9.0.6 (fixed in 9.0.6); version 9.1.0 only

Published 2021-08-05. Last modified 2026-06-17.