| Title | cURL における誤って解決された名前や参照の使用に関する脆弱性 |
|---|---|
| Summary | cURL には、誤って解決された名前や参照の使用に関する脆弱性が存在します。 |
| Possible impacts | 情報を取得される可能性があります。 |
| Solution | ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。 |
| Publication Date | June 11, 2021, midnight |
| Registration Date | May 19, 2022, 5:09 p.m. |
| Last Update | Sept. 19, 2025, 5:27 p.m. |
| CVSS3.0 : 低 | |
| Score | 3.7 |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
| CVSS2.0 : 警告 | |
| Score | 4.3 |
|---|---|
| Vector | AV:N/AC:M/Au:N/C:P/I:N/A:N |
| オラクル |
| MySQL |
| PeopleSoft Enterprise PeopleTools |
| 日立 |
| 日立高信頼サーバ RV3000 |
| Debian |
| Debian GNU/Linux |
| Fedora Project |
| Fedora |
| Haxx |
| cURL |
| NetApp |
| NetApp SolidFire & HCI Management Node |
| ONTAP (旧 Clustered Data ONTAP) |
| No | Changed Details | Date of change |
|---|---|---|
| 1 | [2022年05月19日] 掲載 |
May 19, 2022, 5:09 p.m. |
| 2 | [2023年02月20日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新 ベンダ情報：日立 (hitachi-sec-2023-204) を追加 |
Feb. 20, 2023, 1:53 p.m. |
| 3 | [2025年09月19日] 参考情報：JVN (JVNVU#99030761) を追加 |
Sept. 19, 2025, 4:45 p.m. |
| Summary | libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary depending on used file systems.The comparison also didn't include the 'issuer cert' which a transfer can setto qualify how to verify the server certificate. |
|---|---|
| Publication Date | Aug. 6, 2021, 6:15 a.m. |
| Registration Date | Aug. 6, 2021, 10 a.m. |
| Last Update | Nov. 21, 2024, 2:50 p.m. |
| Configuration1 | or higher | or less | more than | less than | |
| cpe:2.3:a:haxx:libcurl:*:*:*:*:*:*:*:* | 7.10.4 | 7.77.0 | |||
| Configuration2 | or higher | or less | more than | less than | |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | |||||
| Configuration3 | or higher | or less | more than | less than | |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | |||||
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | |||||
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | |||||
| Configuration4 | or higher | or less | more than | less than | |
| cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:* | |||||
| cpe:2.3:o:netapp:solidfire_baseboard_management_controller_firmware:-:*:*:*:*:*:*:* | |||||
| Configuration5 | or higher | or less | more than | less than | |
| cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* | 8.0.0 | 8.0.26 | |||
| cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* | 5.7.0 | 5.7.36 | |||
| Configuration6 | or higher | or less | more than | less than | |
| cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:* | 1.0.1.1 | ||||
| cpe:2.3:a:siemens:sinema_remote_connect_server:*:*:*:*:*:*:*:* | 3.1 | ||||
| Configuration7 | or higher | or less | more than | less than | |
| cpe:2.3:o:siemens:logo\!_cmr2040_firmware:*:*:*:*:*:*:*:* | |||||
| execution environment | |||||
| 1 | cpe:2.3:h:siemens:logo\!_cmr2040:-:*:*:*:*:*:*:* | ||||
| Configuration8 | or higher | or less | more than | less than | |
| cpe:2.3:o:siemens:logo\!_cmr2020_firmware:*:*:*:*:*:*:*:* | |||||
| execution environment | |||||
| 1 | cpe:2.3:h:siemens:logo\!_cmr2020:-:*:*:*:*:*:*:* | ||||
| Configuration9 | or higher | or less | more than | less than | |
| cpe:2.3:o:siemens:ruggedcomrm_1224_lte_firmware:*:*:*:*:*:*:*:* | 7.1 | ||||
| execution environment | |||||
| 1 | cpe:2.3:h:siemens:ruggedcomrm_1224_lte:-:*:*:*:*:*:*:* | ||||
| Configuration10 | or higher | or less | more than | less than | |
| cpe:2.3:o:siemens:scalance_m804pb_firmware:*:*:*:*:*:*:*:* | 7.1 | ||||
| execution environment | |||||
| 1 | cpe:2.3:h:siemens:scalance_m804pb:-:*:*:*:*:*:*:* | ||||
| Configuration11 | or higher | or less | more than | less than | |
| cpe:2.3:o:siemens:scalance_m812-1_firmware:*:*:*:*:*:*:*:* | 7.1 | ||||
| execution environment | |||||
| 1 | cpe:2.3:h:siemens:scalance_m812-1:-:*:*:*:*:*:*:* | ||||
| Configuration12 | or higher | or less | more than | less than | |
| cpe:2.3:o:siemens:scalance_m816-1_firmware:*:*:*:*:*:*:*:* | 7.1 | ||||
| execution environment | |||||
| 1 | cpe:2.3:h:siemens:scalance_m816-1:-:*:*:*:*:*:*:* | ||||
| Configuration13 | or higher | or less | more than | less than | |
| cpe:2.3:o:siemens:scalance_m826-2_firmware:*:*:*:*:*:*:*:* | 7.1 | ||||
| execution environment | |||||
| 1 | cpe:2.3:h:siemens:scalance_m826-2:-:*:*:*:*:*:*:* | ||||
| Configuration14 | or higher | or less | more than | less than | |
| cpe:2.3:o:siemens:scalance_m874-2_firmware:*:*:*:*:*:*:*:* | 7.1 | ||||
| execution environment | |||||
| 1 | cpe:2.3:h:siemens:scalance_m874-2:-:*:*:*:*:*:*:* | ||||
| Configuration15 | or higher | or less | more than | less than | |
| cpe:2.3:o:siemens:scalance_m874-3_firmware:*:*:*:*:*:*:*:* | 7.1 | ||||
| execution environment | |||||
| 1 | cpe:2.3:h:siemens:scalance_m874-3:-:*:*:*:*:*:*:* | ||||
| Configuration16 | or higher | or less | more than | less than | |
| cpe:2.3:o:siemens:scalance_m876-3_firmware:*:*:*:*:*:*:*:* | 7.1 | ||||
| execution environment | |||||
| 1 | cpe:2.3:h:siemens:scalance_m876-3:-:*:*:*:*:*:*:* | ||||
| Configuration17 | or higher | or less | more than | less than | |
| cpe:2.3:o:siemens:scalance_m876-4_firmware:*:*:*:*:*:*:*:* | 7.1 | ||||
| execution environment | |||||
| 1 | cpe:2.3:h:siemens:scalance_m876-4:-:*:*:*:*:*:*:* | ||||
| Configuration18 | or higher | or less | more than | less than | |
| cpe:2.3:o:siemens:scalance_mum856-1_firmware:*:*:*:*:*:*:*:* | 7.1 | ||||
| execution environment | |||||
| 1 | cpe:2.3:h:siemens:scalance_mum856-1:-:*:*:*:*:*:*:* | ||||
| Configuration19 | or higher | or less | more than | less than | |
| cpe:2.3:o:siemens:scalance_s615_firmware:*:*:*:*:*:*:*:* | 7.1 | ||||
| execution environment | |||||
| 1 | cpe:2.3:h:siemens:scalance_s615:-:*:*:*:*:*:*:* | ||||
| Configuration20 | or higher | or less | more than | less than | |
| cpe:2.3:o:siemens:simatic_cp_1543-1_firmware:*:*:*:*:*:*:*:* | 3.0.22 | ||||
| execution environment | |||||
| 1 | cpe:2.3:h:siemens:simatic_cp_1543-1:-:*:*:*:*:*:*:* | ||||
| Configuration21 | or higher | or less | more than | less than | |
| cpe:2.3:o:siemens:simatic_cp_1545-1_firmware:*:*:*:*:*:*:*:* | 1.1 | ||||
| execution environment | |||||
| 1 | cpe:2.3:h:siemens:simatic_cp_1545-1:-:*:*:*:*:*:*:* | ||||
| Configuration22 | or higher | or less | more than | less than | |
| cpe:2.3:o:siemens:simatic_rtu3010c_firmware:*:*:*:*:*:*:*:* | 5.0.14 | ||||
| execution environment | |||||
| 1 | cpe:2.3:h:siemens:simatic_rtu3010c:-:*:*:*:*:*:*:* | ||||
| Configuration23 | or higher | or less | more than | less than | |
| cpe:2.3:o:siemens:simatic_rtu3030c_firmware:*:*:*:*:*:*:*:* | 5.0.14 | ||||
| execution environment | |||||
| 1 | cpe:2.3:h:siemens:simatic_rtu3030c:-:*:*:*:*:*:*:* | ||||
| Configuration24 | or higher | or less | more than | less than | |
| cpe:2.3:o:siemens:simatic_rtu3031c_firmware:*:*:*:*:*:*:*:* | 5.0.14 | ||||
| execution environment | |||||
| 1 | cpe:2.3:h:siemens:simatic_rtu3031c:-:*:*:*:*:*:*:* | ||||
| Configuration25 | or higher | or less | more than | less than | |
| cpe:2.3:o:siemens:simatic_rtu_3041c_firmware:*:*:*:*:*:*:*:* | 5.0.14 | ||||
| execution environment | |||||
| 1 | cpe:2.3:h:siemens:simatic_rtu_3041c:-:*:*:*:*:*:*:* | ||||
| Configuration26 | or higher | or less | more than | less than | |
| cpe:2.3:a:siemens:sinema_remote_connect:*:*:*:*:*:*:*:* | 3.1 | ||||
| Configuration27 | or higher | or less | more than | less than | |
| cpe:2.3:o:siemens:siplus_net_cp_1543-1_firmware:*:*:*:*:*:*:*:* | 3.0.22 | ||||
| execution environment | |||||
| 1 | cpe:2.3:h:siemens:siplus_net_cp_1543-1:-:*:*:*:*:*:*:* | ||||
| Configuration28 | or higher | or less | more than | less than | |
| cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:* | 9.0.0 | 9.0.6 | |||
| cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:* | 8.2.0 | 8.2.12 | |||