CVE-2021-22925: Apple Mac OS X
Medium severity, CVSS 5.3. EPSS: 4.9% chance of exploitation in the next 30 days.
curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending `NEW_ENV` variables, libcurlcould be made to pass on uninitialized data from a stack based buffer to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing the string provided by the application.
Affected products
- Apple Mac OS X: version 10.15.7 only
- Apple macOS: version 11.0 only; version 11.0.1 only; version 11.1 only; version 11.1.0 only; version 11.2 only; version 11.2.1 only; …
- Fedoraproject Fedora: version 33 only
- Haxx Curl: from 7.7, before 7.78.0 (fixed in 7.78.0)
- Netapp Cloud Backup: affected versions not specified
- Netapp Clustered Data Ontap: affected versions not specified
- Netapp h300e Firmware: affected versions not specified
- Netapp h300s Firmware: affected versions not specified
- Netapp h410s Firmware: affected versions not specified
- Netapp h500e Firmware: affected versions not specified
- Netapp h500s Firmware: affected versions not specified
- Netapp h700e Firmware: affected versions not specified
- Netapp h700s Firmware: affected versions not specified
- Netapp Hci Management Node: affected versions not specified
- Netapp Solidfire: affected versions not specified
- Oracle MySQL Server: from 5.7.0, up to and including 5.7.35; from 8.0.0, up to and including 8.0.26
- Oracle PeopleSoft Enterprise PeopleTools: version 8.57 only; version 8.58 only; version 8.59 only
- Siemens Sinec Infrastructure Network Services: before 1.0.1.1 (fixed in 1.0.1.1)
- Siemens Sinema Remote Connect Server: before 3.1 (fixed in 3.1)
- Splunk Universal Forwarder: from 8.2.0, before 8.2.12 (fixed in 8.2.12); from 9.0.0, before 9.0.6 (fixed in 9.0.6); version 9.1.0 only
Published 2021-08-05. Last modified 2026-06-17.