Vulnerabilities > CVE-2021-22925 - Use of Uninitialized Resource vulnerability in multiple products

curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending `NEW_ENV` variables, libcurlcould be made to pass on uninitialized data from a stack based buffer to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing the string provided by the application.

Vulnerable Configurations

Part	Description	Count
Application	Haxx Haxx Curl 7.7 Haxx Curl 7.7.1 Haxx Curl 7.7.2 Haxx Curl 7.7.3 Haxx Curl 7.8 Haxx Curl 7.8.1 Haxx Curl 7.9 Haxx Curl 7.9.1 Haxx Curl 7.9.2 Haxx Curl 7.9.3 Haxx Curl 7.9.4 Haxx Curl 7.9.5 Haxx Curl 7.9.6 Haxx Curl 7.9.7 Haxx Curl 7.9.8 Haxx Curl 7.10 Haxx Curl 7.10.1 Haxx Curl 7.10.2 Haxx Curl 7.10.3 Haxx Curl 7.10.4 Haxx Curl 7.10.5 Haxx Curl 7.10.6 Haxx Curl 7.10.7 Haxx Curl 7.10.8 Haxx Curl 7.11.0 Haxx Curl 7.11.1 Haxx Curl 7.11.2 Haxx Curl 7.12.0 Haxx Curl 7.12.1 Haxx Curl 7.12.2 Haxx Curl 7.12.3 Haxx Curl 7.13.0 Haxx Curl 7.13.1 Haxx Curl 7.13.2 Haxx Curl 7.14.0 Haxx Curl 7.14.1 Haxx Curl 7.15.0 Haxx Curl 7.15.1 Haxx Curl 7.15.2 Haxx Curl 7.15.3 Haxx Curl 7.15.4 Haxx Curl 7.15.5 Haxx Curl 7.16.0 Haxx Curl 7.16.1 Haxx Curl 7.16.2 Haxx Curl 7.16.3 Haxx Curl 7.16.4 Haxx Curl 7.17.0 Haxx Curl 7.17.1 Haxx Curl 7.18.0 Haxx Curl 7.18.1 Haxx Curl 7.18.2 Haxx Curl 7.19.0 Haxx Curl 7.19.1 Haxx Curl 7.19.2 Haxx Curl 7.19.3 Haxx Curl 7.19.4 Haxx Curl 7.19.5 Haxx Curl 7.19.6 Haxx Curl 7.19.7 Haxx Curl 7.19.7-53 Haxx Curl 7.20.0 Haxx Curl 7.20.1 Haxx Curl 7.21.0 Haxx Curl 7.21.1 Haxx Curl 7.21.2 Haxx Curl 7.21.3 Haxx Curl 7.21.4 Haxx Curl 7.21.5 Haxx Curl 7.21.6 Haxx Curl 7.21.7 Haxx Curl 7.22.0 Haxx Curl 7.23.0 Haxx Curl 7.23.1 Haxx Curl 7.24.0 Haxx Curl 7.25.0 Haxx Curl 7.26.0 Haxx Curl 7.27.0 Haxx Curl 7.28.0 Haxx Curl 7.28.1 Haxx Curl 7.29.0 Haxx Curl 7.30.0 Haxx Curl 7.31.0 Haxx Curl 7.32.0 Haxx Curl 7.33.0 Haxx Curl 7.34.0 Haxx Curl 7.35.0 Haxx Curl 7.36.0 Haxx Curl 7.37.0 Haxx Curl 7.37.1 Haxx Curl 7.38.0 Haxx Curl 7.39.0 Haxx Curl 7.40.0 Haxx Curl 7.41.0 Haxx Curl 7.42.0 Haxx Curl 7.42.1 Haxx Curl 7.43.0 Haxx Curl 7.44.0 Haxx Curl 7.45.0 Haxx Curl 7.46.0 Haxx Curl 7.47.0 Haxx Curl 7.47.1 Haxx Curl 7.48.0 Haxx Curl 7.49.0 Haxx Curl 7.49.1 Haxx Curl 7.50.0 Haxx Curl 7.50.1 Haxx Curl 7.50.2 Haxx Curl 7.50.3 Haxx Curl 7.51.0 Haxx Curl 7.52.0 Haxx Curl 7.52.1 Haxx Curl 7.53.0 Haxx Curl 7.53.1 Haxx Curl 7.54.0 Haxx Curl 7.54.1 Haxx Curl 7.55.0 Haxx Curl 7.55.1 Haxx Curl 7.56.0 Haxx Curl 7.56.1 Haxx Curl 7.57.0 Haxx Curl 7.58.0 Haxx Curl 7.59.0 Haxx Curl 7.60.0 Haxx Curl 7.61.0 Haxx Curl 7.61.1 Haxx Curl 7.62.0 Haxx Curl 7.63.0 Haxx Curl 7.64.0 Haxx Curl 7.64.1 Haxx Curl 7.65.0 Haxx Curl 7.65.1 Haxx Curl 7.65.2 Haxx Curl 7.65.3 Haxx Curl 7.66.0 Haxx Curl 7.67.0 Haxx Curl 7.68.0 Haxx Curl 7.69.0 Haxx Curl 7.69.1 Haxx Curl 7.70.0 Haxx Curl 7.71.0 Haxx Curl 7.71.1 Haxx Curl 7.72.0 Haxx Curl 7.73.0 Haxx Curl 7.74.0 Haxx Curl 7.75.0 Haxx Curl 7.76.0 Haxx Curl 7.76.1 Haxx Curl 7.77.0	151
Application	Netapp Netapp Cloud Backup - Netapp Clustered Data Ontap - Netapp Solidfire - Netapp HCI Management Node -	4
Application	Oracle Oracle Peoplesoft Enterprise Peopletools 8.57 Oracle Peoplesoft Enterprise Peopletools 8.58 Oracle Peoplesoft Enterprise Peopletools 8.59 Oracle Mysql Server 8.0.0 Oracle Mysql Server 8.0.15 Oracle Mysql Server 8.0.17 Oracle Mysql Server 8.0.22 Oracle Mysql Server 8.0.23 Oracle Mysql Server 8.0.24 Oracle Mysql Server 8.0.25 Oracle Mysql Server 8.0.26 Oracle Mysql Server 5.7.0 Oracle Mysql Server 5.7.26 Oracle Mysql Server 5.7.27 Oracle Mysql Server 5.7.28 Oracle Mysql Server 5.7.32 Oracle Mysql Server 5.7.33 Oracle Mysql Server 5.7.34 Oracle Mysql Server 5.7.35	19
Application	Siemens Siemens Sinec Infrastructure Network Services - Siemens Sinec Infrastructure Network Services 1.0.1 Siemens Sinema Remote Connect Server - Siemens Sinema Remote Connect Server 1.0 Siemens Sinema Remote Connect Server 1.1 Siemens Sinema Remote Connect Server 1.2 Siemens Sinema Remote Connect Server 1.3 Siemens Sinema Remote Connect Server 2.0 Siemens Sinema Remote Connect Server 3.0	11
Application	Splunk Splunk Universal Forwarder 9.1.0 Splunk Universal Forwarder 9.0.0 Splunk Universal Forwarder 9.0.1 Splunk Universal Forwarder 9.0.2 Splunk Universal Forwarder 9.0.3 Splunk Universal Forwarder 9.0.4 Splunk Universal Forwarder 9.0.5 Splunk Universal Forwarder 8.2.0 Splunk Universal Forwarder 8.2.6 Splunk Universal Forwarder 8.2.7 Splunk Universal Forwarder 8.2.8 Splunk Universal Forwarder 8.2.9 Splunk Universal Forwarder 8.2.10 Splunk Universal Forwarder 8.2.11	14
OS	Fedoraproject Fedoraproject Fedora 33	1
OS	Apple Apple Macos 11.0 Apple Macos 11.0.1 Apple Macos 11.1 Apple Macos 11.1.0 Apple Macos 11.2 Apple Macos 11.2.1 Apple Macos 11.3 Apple Macos 11.3.1 Apple Macos 11.4 Apple Macos 11.5 Apple MAC OS X 10.15.7	15
OS	Netapp Netapp H300S Firmware - Netapp H500S Firmware - Netapp H700S Firmware - Netapp H300E Firmware - Netapp H500E Firmware - Netapp H700E Firmware - Netapp H410S Firmware -	7
Hardware	Netapp Netapp H300S - Netapp H500S - Netapp H700S - Netapp H300E - Netapp H500E - Netapp H700E - Netapp H410S -	7

Common Weakness Enumeration (CWE)

CWE-908 - Use of Uninitialized Resource

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References