TNCVE-2021-22925 | Vulnetix

TNCVE-2021-22925 PUBLISHED

Record from tenable · Published August 5, 2021

curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending `NEW_ENV` variables, libcurlcould be made to pass on uninitialized data from a stack based buffer to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing the string provided by the application.

Timeline

Aug 5, 2021 CVE Published

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln TNCVE-2021-22925
vulnetix vdb fixes TNCVE-2021-22925

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/TNCVE-2021-22925/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Tenable: CVE-2021-22925 advisory

Look up in the Resolve Platform →