Medium · published June 11, 2021
curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.
| Product | Versions | Fixed in |
|---|---|---|
| haxx/curl | ≥ 7.61.0, ≤ 7.76.1 | — |
| oracle/communications_cloud_native_core_binding_support_function | all versions | — |
| oracle/communications_cloud_native_core_network_function_cloud_native_environment | all versions | — |
| oracle/communications_cloud_native_core_network_repository_function | all versions | — |
| oracle/communications_cloud_native_core_network_repository_function | all versions | — |
| oracle/communications_cloud_native_core_network_slice_selection_function | all versions | — |
| oracle/communications_cloud_native_core_service_communication_proxy | all versions | — |
| oracle/essbase | < 11.1.2.4.047 | 11.1.2.4.047 |
| oracle/essbase | ≥ 21.0, < 21.3 | 21.3 |
| oracle/mysql_server | ≤ 5.7.34 | — |
| oracle/mysql_server | ≥ 8.0.0, ≤ 8.0.25 | — |
| netapp/cloud_backup | all versions | — |
| netapp/solidfire\,_enterprise_sds_\&_hci_storage_node | all versions | — |
| netapp/solidfire_\&_hci_management_node | all versions | — |
| netapp/solidfire_baseboard_management_controller_firmware | all versions | — |
| netapp/hci_compute_node_firmware | all versions | — |
| netapp/h300e_firmware | all versions | — |
| netapp/h300s_firmware | all versions | — |
| netapp/h410s_firmware | all versions | — |
| netapp/h500e_firmware | all versions | — |
| netapp/h500s_firmware | all versions | — |
| netapp/h700e_firmware | all versions | — |
| netapp/h700s_firmware | all versions | — |
| siemens/sinec_infrastructure_network_services | < 1.0.1.1 | 1.0.1.1 |
| splunk/universal_forwarder | ≥ 8.2.0, < 8.2.12 | 8.2.12 |
| splunk/universal_forwarder | ≥ 9.0.0, < 9.0.6 | 9.0.6 |
| splunk/universal_forwarder | all versions | — |