CVE-2021-22946

Publication date 15 September 2021

Last updated 25 August 2025

Ubuntu priority

Cvss 3 Severity Score

Description

A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations **withoutTLS** contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
curl	22.04 LTS jammy	Fixed 7.74.0-1.3ubuntu2
	21.10 impish	Fixed 7.74.0-1.3ubuntu2
	21.04 hirsute	Fixed 7.74.0-1ubuntu2.3
	20.04 LTS focal	Fixed 7.68.0-1ubuntu2.7
	18.04 LTS bionic	Fixed 7.58.0-2ubuntu3.15
	16.04 LTS xenial	Fixed 7.47.0-1ubuntu2.19+esm1
	14.04 LTS trusty	Fixed 7.35.0-1ubuntu2.20+esm8

Get expanded security coverage with Ubuntu Pro

Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.

Get Ubuntu Pro 30-day free trial

Notes

mdeslaur

introduced by: https://github.com/curl/curl/commit/ec3bb8f727405 and https://github.com/curl/curl/commit/c5ba0c2f544653

Severity score breakdown

Parameter	Value
Base score	7.5 · High
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	None
Availability impact	None
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N