CVE-2021-22945

Publication date 15 September 2021

Last updated 25 August 2025

Ubuntu priority

Cvss 3 Severity Score

Description

When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and both use that again in a subsequent call to send data and also free it *again*.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
curl	22.04 LTS jammy	Fixed 7.74.0-1.3ubuntu2
	21.10 impish	Fixed 7.74.0-1.3ubuntu2
	21.04 hirsute	Fixed 7.74.0-1ubuntu2.3
	20.04 LTS focal	Not affected
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not affected

Notes

alexmurray

MQTT sending support is only present in curl >= 7.70 - see Message-ID: <nycvar.QRO.7.76.2109061032590.1742@fvyyl>

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
curl	Upstream: 4315749

Severity score breakdown

Parameter	Value
Base score	9.1 · Critical
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	None
Availability impact	High
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

References

Related Ubuntu Security Notices (USN)

USN-5079-1
curl vulnerabilities
15 September 2021