CVE-2021-22924: Debian Linux

Low severity, CVSS 3.7. EPSS: 6.3% chance of exploitation in the next 30 days.

libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary depending on used file systems.The comparison also didn't include the 'issuer cert' which a transfer can setto qualify how to verify the server certificate.

Affected products

  • Debian Debian Linux: version 9.0 only; version 10.0 only; version 11.0 only
  • Fedoraproject Fedora: version 33 only
  • Haxx Libcurl: from 7.10.4, before 7.77.0 (fixed in 7.77.0)
  • Netapp Cloud Backup: affected versions not specified
  • Netapp Clustered Data Ontap: affected versions not specified
  • Netapp Solidfire & Hci Management Node: affected versions not specified
  • Netapp Solidfire Baseboard Management Controller Firmware: affected versions not specified
  • Oracle MySQL Server: from 5.7.0, up to and including 5.7.36; from 8.0.0, up to and including 8.0.26
  • Oracle PeopleSoft Enterprise PeopleTools: version 8.57 only; version 8.58 only; version 8.59 only
  • Siemens Logo! CMR2020 Firmware: any version
  • Siemens Logo! CMR2040 Firmware: any version
  • Siemens Ruggedcomrm 1224 Lte Firmware: before 7.1 (fixed in 7.1)
  • Siemens Scalance m804pb Firmware: before 7.1 (fixed in 7.1)
  • Siemens Scalance m812-1 Firmware: before 7.1 (fixed in 7.1)
  • Siemens Scalance m816-1 Firmware: before 7.1 (fixed in 7.1)
  • Siemens Scalance m826-2 Firmware: before 7.1 (fixed in 7.1)
  • Siemens Scalance m874-2 Firmware: before 7.1 (fixed in 7.1)
  • Siemens Scalance m874-3 Firmware: before 7.1 (fixed in 7.1)
  • Siemens Scalance m876-3 Firmware: before 7.1 (fixed in 7.1)
  • Siemens Scalance m876-4 Firmware: before 7.1 (fixed in 7.1)
  • Siemens Scalance MUM856-1 Firmware: before 7.1 (fixed in 7.1)
  • Siemens Scalance s615 Firmware: before 7.1 (fixed in 7.1)
  • Siemens SIMATIC CP 1543-1 Firmware: before 3.0.22 (fixed in 3.0.22)
  • Siemens SIMATIC CP 1545-1 Firmware: before 1.1 (fixed in 1.1)
  • Siemens SIMATIC RTU3010C Firmware: before 5.0.14 (fixed in 5.0.14)
  • and 8 more

Published 2021-08-05. Last modified 2026-06-17.