CVE-2021-22926 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2021-22926 Interim 1 37 2025-02-17T00:50:59Z current 2021-11-17T02:04:56Z 2025-02-17T00:50:59Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2021-22926 libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the `CURLOPT_SSLCERT` option (`--cert` with the command line tool).When libcurl is built to use the macOS native TLS library Secure Transport, an application can ask for the client certificate by name or with a file name - using the same option. If the name exists as a file, it will be used instead of by name.If the appliction runs with a current working directory that is writable by other users (like `/tmp`), a malicious user can create a file name with the same name as the app wants to use by name, and thereby trick the application to use the file based cert instead of the one referred to by name making libcurl send the wrong client certificate in the TLS connection handshake. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://www.suse.com/support/security/rating/ SUSE Security Ratings HPE Helion OpenStack 8 SUSE CaaS Platform 4.0 SUSE Enterprise Storage 6 SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise High Performance Computing 12 SP5 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise High Performance Computing 15-LTSS SUSE Linux Enterprise Micro 5.0 SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Point of Service 11 SP3 SUSE Linux Enterprise Server 11 SP1 for Teradata SUSE Linux Enterprise Server 11 SP3 for Teradata SUSE Linux Enterprise Server 11 SP4 LTSS SUSE Linux Enterprise Server 12 SP2-BCL SUSE Linux Enterprise Server 12 SP3-BCL SUSE Linux Enterprise Server 12 SP3-ESPOS SUSE Linux Enterprise Server 12 SP3-LTSS SUSE Linux Enterprise Server 12 SP4-ESPOS SUSE Linux Enterprise Server 12 SP4-LTSS SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server 15 SP1-LTSS SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Server 15-ESPOS SUSE Linux Enterprise Server 15-LTSS SUSE Linux Enterprise Server Business Critical Linux 15 SP1 SUSE Linux Enterprise Server Teradata 12 SP3 SUSE Linux Enterprise Server for SAP Applications 12 SP3 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Server for SAP Applications 15 SUSE Linux Enterprise Server for SAP Applications 15 SP1 SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Manager Proxy 4.0 SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Manager Retail Branch Server 4.0 SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Manager Server 4.0 SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE OpenStack Cloud 8 SUSE OpenStack Cloud 9 SUSE OpenStack Cloud Crowbar 8 SUSE OpenStack Cloud Crowbar 9 openSUSE Tumbleweed curl libcurl-devel libcurl4 libcurl4-32bit tensorflow-lite-2.9.1-1.1 tensorflow-lite-devel-2.9.1-1.1 tensorflow-lite-2.9.1-1.1 as a component of openSUSE Tumbleweed tensorflow-lite-devel-2.9.1-1.1 as a component of openSUSE Tumbleweed curl as a component of HPE Helion OpenStack 8 libcurl4 as a component of HPE Helion OpenStack 8 libcurl4-32bit as a component of HPE Helion OpenStack 8 curl as a component of SUSE CaaS Platform 4.0 libcurl-devel as a component of SUSE CaaS Platform 4.0 libcurl4 as a component of SUSE CaaS Platform 4.0 libcurl4-32bit as a component of SUSE CaaS Platform 4.0 curl as a component of SUSE Enterprise Storage 6 curl as a component of SUSE Linux Enterprise High Performance Computing 12 SP5 curl as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS libcurl-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS libcurl4 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS libcurl4-32bit as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS curl as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS libcurl-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS libcurl4 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS libcurl4-32bit as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS curl as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS libcurl-devel as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS libcurl4 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS libcurl4-32bit as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS curl as a component of SUSE Linux Enterprise Micro 5.0 libcurl4 as a component of SUSE Linux Enterprise Micro 5.0 curl as a component of SUSE Linux Enterprise Micro 5.1 libcurl4 as a component of SUSE Linux Enterprise Micro 5.1 curl as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 libcurl-devel as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 libcurl4 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 libcurl4-32bit as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 curl as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 libcurl-devel as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 libcurl4 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 libcurl4-32bit as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 curl as a component of SUSE Linux Enterprise Point of Service 11 SP3 curl as a component of SUSE Linux Enterprise Server 11 SP1 for Teradata curl as a component of SUSE Linux Enterprise Server 11 SP3 for Teradata curl as a component of SUSE Linux Enterprise Server 11 SP4 LTSS curl as a component of SUSE Linux Enterprise Server 12 SP2-BCL libcurl4 as a component of SUSE Linux Enterprise Server 12 SP2-BCL libcurl4-32bit as a component of SUSE Linux Enterprise Server 12 SP2-BCL curl as a component of SUSE Linux Enterprise Server 12 SP3-BCL libcurl4 as a component of SUSE Linux Enterprise Server 12 SP3-BCL libcurl4-32bit as a component of SUSE Linux Enterprise Server 12 SP3-BCL curl as a component of SUSE Linux Enterprise Server 12 SP3-ESPOS libcurl4 as a component of SUSE Linux Enterprise Server 12 SP3-ESPOS libcurl4-32bit as a component of SUSE Linux Enterprise Server 12 SP3-ESPOS curl as a component of SUSE Linux Enterprise Server 12 SP3-LTSS libcurl4 as a component of SUSE Linux Enterprise Server 12 SP3-LTSS libcurl4-32bit as a component of SUSE Linux Enterprise Server 12 SP3-LTSS curl as a component of SUSE Linux Enterprise Server 12 SP4-ESPOS libcurl4 as a component of SUSE Linux Enterprise Server 12 SP4-ESPOS libcurl4-32bit as a component of SUSE Linux Enterprise Server 12 SP4-ESPOS curl as a component of SUSE Linux Enterprise Server 12 SP4-LTSS libcurl4 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS libcurl4-32bit as a component of SUSE Linux Enterprise Server 12 SP4-LTSS curl as a component of SUSE Linux Enterprise Server 12 SP5 libcurl4 as a component of SUSE Linux Enterprise Server 12 SP5 libcurl4-32bit as a component of SUSE Linux Enterprise Server 12 SP5 curl as a component of SUSE Linux Enterprise Server 15 SP1-LTSS libcurl-devel as a component of SUSE Linux Enterprise Server 15 SP1-LTSS libcurl4 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS libcurl4-32bit as a component of SUSE Linux Enterprise Server 15 SP1-LTSS curl as a component of SUSE Linux Enterprise Server 15-ESPOS curl as a component of SUSE Linux Enterprise Server 15-LTSS libcurl-devel as a component of SUSE Linux Enterprise Server 15-LTSS libcurl4 as a component of SUSE Linux Enterprise Server 15-LTSS libcurl4-32bit as a component of SUSE Linux Enterprise Server 15-LTSS curl as a component of SUSE Linux Enterprise Server Business Critical Linux 15 SP1 curl as a component of SUSE Linux Enterprise Server Teradata 12 SP3 curl as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 libcurl4 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 libcurl4-32bit as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 curl as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 libcurl4 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 libcurl4-32bit as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 curl as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 curl as a component of SUSE Linux Enterprise Server for SAP Applications 15 libcurl-devel as a component of SUSE Linux Enterprise Server for SAP Applications 15 libcurl4 as a component of SUSE Linux Enterprise Server for SAP Applications 15 libcurl4-32bit as a component of SUSE Linux Enterprise Server for SAP Applications 15 curl as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 libcurl-devel as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 libcurl4 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 libcurl4-32bit as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 curl as a component of SUSE Manager Proxy 4.0 curl as a component of SUSE Manager Retail Branch Server 4.0 curl as a component of SUSE Manager Server 4.0 curl as a component of SUSE OpenStack Cloud 8 libcurl4 as a component of SUSE OpenStack Cloud 8 libcurl4-32bit as a component of SUSE OpenStack Cloud 8 curl as a component of SUSE OpenStack Cloud 9 libcurl4 as a component of SUSE OpenStack Cloud 9 libcurl4-32bit as a component of SUSE OpenStack Cloud 9 curl as a component of SUSE OpenStack Cloud Crowbar 8 libcurl4 as a component of SUSE OpenStack Cloud Crowbar 8 libcurl4-32bit as a component of SUSE OpenStack Cloud Crowbar 8 curl as a component of SUSE OpenStack Cloud Crowbar 9 libcurl4 as a component of SUSE OpenStack Cloud Crowbar 9 libcurl4-32bit as a component of SUSE OpenStack Cloud Crowbar 9 libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the `CURLOPT_SSLCERT` option (`--cert` with the command line tool).When libcurl is built to use the macOS native TLS library Secure Transport, an application can ask for the client certificate by name or with a file name - using the same option. If the name exists as a file, it will be used instead of by name.If the appliction runs with a current working directory that is writable by other users (like `/tmp`), a malicious user can create a file name with the same name as the app wants to use by name, and thereby trick the application to use the file based cert instead of the one referred to by name making libcurl send the wrong client certificate in the TLS connection handshake. CVE-2021-22926 openSUSE Tumbleweed:tensorflow-lite-2.9.1-1.1 openSUSE Tumbleweed:tensorflow-lite-devel-2.9.1-1.1 HPE Helion OpenStack 8:curl HPE Helion OpenStack 8:libcurl4 HPE Helion OpenStack 8:libcurl4-32bit SUSE CaaS Platform 4.0:curl SUSE CaaS Platform 4.0:libcurl-devel SUSE CaaS Platform 4.0:libcurl4 SUSE CaaS Platform 4.0:libcurl4-32bit SUSE Enterprise Storage 6:curl SUSE Linux Enterprise High Performance Computing 12 SP5:curl SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:curl SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:libcurl-devel SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:libcurl4 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:libcurl4-32bit SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:curl SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libcurl-devel SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libcurl4 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libcurl4-32bit SUSE Linux Enterprise High Performance Computing 15-LTSS:curl SUSE Linux Enterprise High Performance Computing 15-LTSS:libcurl-devel SUSE Linux Enterprise High Performance Computing 15-LTSS:libcurl4 SUSE Linux Enterprise High Performance Computing 15-LTSS:libcurl4-32bit SUSE Linux Enterprise Micro 5.0:curl SUSE Linux Enterprise Micro 5.0:libcurl4 SUSE Linux Enterprise Micro 5.1:curl SUSE Linux Enterprise Micro 5.1:libcurl4 SUSE Linux Enterprise Module for Basesystem 15 SP2:curl SUSE Linux Enterprise Module for Basesystem 15 SP2:libcurl-devel SUSE Linux Enterprise Module for Basesystem 15 SP2:libcurl4 SUSE Linux Enterprise Module for Basesystem 15 SP2:libcurl4-32bit SUSE Linux Enterprise Module for Basesystem 15 SP3:curl SUSE Linux Enterprise Module for Basesystem 15 SP3:libcurl-devel SUSE Linux Enterprise Module for Basesystem 15 SP3:libcurl4 SUSE Linux Enterprise Module for Basesystem 15 SP3:libcurl4-32bit SUSE Linux Enterprise Point of Service 11 SP3:curl SUSE Linux Enterprise Server 11 SP1 for Teradata:curl SUSE Linux Enterprise Server 11 SP3 for Teradata:curl SUSE Linux Enterprise Server 11 SP4 LTSS:curl SUSE Linux Enterprise Server 12 SP2-BCL:curl SUSE Linux Enterprise Server 12 SP2-BCL:libcurl4 SUSE Linux Enterprise Server 12 SP2-BCL:libcurl4-32bit SUSE Linux Enterprise Server 12 SP3-BCL:curl SUSE Linux Enterprise Server 12 SP3-BCL:libcurl4 SUSE Linux Enterprise Server 12 SP3-BCL:libcurl4-32bit SUSE Linux Enterprise Server 12 SP3-ESPOS:curl SUSE Linux Enterprise Server 12 SP3-ESPOS:libcurl4 SUSE Linux Enterprise Server 12 SP3-ESPOS:libcurl4-32bit SUSE Linux Enterprise Server 12 SP3-LTSS:curl SUSE Linux Enterprise Server 12 SP3-LTSS:libcurl4 SUSE Linux Enterprise Server 12 SP3-LTSS:libcurl4-32bit SUSE Linux Enterprise Server 12 SP4-ESPOS:curl SUSE Linux Enterprise Server 12 SP4-ESPOS:libcurl4 SUSE Linux Enterprise Server 12 SP4-ESPOS:libcurl4-32bit SUSE Linux Enterprise Server 12 SP4-LTSS:curl SUSE Linux Enterprise Server 12 SP4-LTSS:libcurl4 SUSE Linux Enterprise Server 12 SP4-LTSS:libcurl4-32bit SUSE Linux Enterprise Server 12 SP5:curl SUSE Linux Enterprise Server 12 SP5:libcurl4 SUSE Linux Enterprise Server 12 SP5:libcurl4-32bit SUSE Linux Enterprise Server 15 SP1-LTSS:curl SUSE Linux Enterprise Server 15 SP1-LTSS:libcurl-devel SUSE Linux Enterprise Server 15 SP1-LTSS:libcurl4 SUSE Linux Enterprise Server 15 SP1-LTSS:libcurl4-32bit SUSE Linux Enterprise Server 15-ESPOS:curl SUSE Linux Enterprise Server 15-LTSS:curl SUSE Linux Enterprise Server 15-LTSS:libcurl-devel SUSE Linux Enterprise Server 15-LTSS:libcurl4 SUSE Linux Enterprise Server 15-LTSS:libcurl4-32bit SUSE Linux Enterprise Server Business Critical Linux 15 SP1:curl SUSE Linux Enterprise Server Teradata 12 SP3:curl SUSE Linux Enterprise Server for SAP Applications 12 SP3:curl SUSE Linux Enterprise Server for SAP Applications 12 SP3:libcurl4 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libcurl4-32bit SUSE Linux Enterprise Server for SAP Applications 12 SP4:curl SUSE Linux Enterprise Server for SAP Applications 12 SP4:libcurl4 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libcurl4-32bit SUSE Linux Enterprise Server for SAP Applications 12 SP5:curl SUSE Linux Enterprise Server for SAP Applications 15 SP1:curl SUSE Linux Enterprise Server for SAP Applications 15 SP1:libcurl-devel SUSE Linux Enterprise Server for SAP Applications 15 SP1:libcurl4 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libcurl4-32bit SUSE Linux Enterprise Server for SAP Applications 15:curl SUSE Linux Enterprise Server for SAP Applications 15:libcurl-devel SUSE Linux Enterprise Server for SAP Applications 15:libcurl4 SUSE Linux Enterprise Server for SAP Applications 15:libcurl4-32bit SUSE Manager Proxy 4.0:curl SUSE Manager Retail Branch Server 4.0:curl SUSE Manager Server 4.0:curl SUSE OpenStack Cloud 8:curl SUSE OpenStack Cloud 8:libcurl4 SUSE OpenStack Cloud 8:libcurl4-32bit SUSE OpenStack Cloud 9:curl SUSE OpenStack Cloud 9:libcurl4 SUSE OpenStack Cloud 9:libcurl4-32bit SUSE OpenStack Cloud Crowbar 8:curl SUSE OpenStack Cloud Crowbar 8:libcurl4 SUSE OpenStack Cloud Crowbar 8:libcurl4-32bit SUSE OpenStack Cloud Crowbar 9:curl SUSE OpenStack Cloud Crowbar 9:libcurl4 SUSE OpenStack Cloud Crowbar 9:libcurl4-32bit important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H