Critical · published September 23, 2021
🚨 A double-dipping memory issue is lurking! When libcurl (versions <= 7.73.0 and 7.78.0) sends data to an MQTT server, it might accidentally reuse freed memory like a reckless chef double-ordering ingredients. 🔥 Think of it like a restaurant where a chef mistakenly uses the same expired ingredients for two different dishes—once served, the customers might get something that's not just stale but could make them sick! An attacker could exploit this gaffe to trigger unexpected behaviors or crashes in applications that rely on this library, leading to potential data loss or system instability. This is absolutely devastating for any applications that depend on libcurl for reliable communication!
Think of it like a restaurant where a chef mistakenly uses the same expired ingredients for two different dishes—once served, the customers might get something that's not just stale but could make them sick! CVE-2021-22945 is a critical vulnerability where libcurl erroneously retains a pointer to freed memory when communicating with an MQTT server. This can lead to double-free errors, causing unpredictable behaviors or memory corruption.
An attacker could exploit this gaffe to trigger unexpected behaviors or crashes in applications that rely on this library, leading to potential data loss or system instability. This is absolutely devastating for any applications that depend on libcurl for reliable communication! To safeguard your applications, upgrade libcurl to versions 7.78.1 or higher immediately. Additionally, review and test your implementation to ensure it doesn’t rely on potentially unstable versions. Don’t wait—act now! You've got this! Follow these steps, and you'll have your systems secured in no time. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| haxx/libcurl | ≥ 7.73.0, ≤ 7.78.0 | — |
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |
| netapp/cloud_backup | all versions | — |
| netapp/clustered_data_ontap | all versions | — |
| oracle/mysql_server | ≥ 5.7.0, ≤ 5.7.35 | — |
| oracle/mysql_server | ≥ 8.0.0, ≤ 8.0.26 | — |
| netapp/h300s_firmware | all versions | — |
| netapp/h500s_firmware | all versions | — |
| netapp/h700s_firmware | all versions | — |
| netapp/h300e_firmware | all versions | — |
| netapp/h500e_firmware | all versions | — |
| netapp/h700e_firmware | all versions | — |
| netapp/h410s_firmware | all versions | — |
| netapp/solidfire_baseboard_management_controller_firmware | all versions | — |
| apple/macos | ≥ 12.0.0, < 12.3 | 12.3 |
| siemens/sinec_ins | < 1.0.1.1 | 1.0.1.1 |
| debian/debian_linux | all versions | — |
| splunk/universal_forwarder | ≥ 8.2.0, < 8.2.12 | 8.2.12 |
| splunk/universal_forwarder | ≥ 9.0.0, < 9.0.6 | 9.0.6 |
| splunk/universal_forwarder | all versions | — |