Alpine: libcurl, multiple curl packages: security update to 7.78.0-r0

medium Tenable Cloud Security Plugin ID 423794

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- When curl is instructed to download content using the metalink feature, thecontents is verified against a
hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same
contentfrom a set of different URLs, potentially hosted by different servers and theclient can then
download the file from one or several of them. In a serial orparallel manner.If one of the servers hosting
the contents has been breached and the contentsof the specific file on that server is replaced with a
modified payload, curlshould detect this when the hash of the file mismatches after a completeddownload.
It should remove the contents and instead try getting the contentsfrom another URL. This is not done, and
instead such a hash mismatch is onlymentioned in text and the potentially malicious content is kept in the
file ondisk. (CVE-2021-22922)

- When curl is instructed to get content using the metalink feature, and a user name and password are used
to download the metalink XML file, those same credentials are then subsequently passed on to each of the
servers from which curl will download or try to download the contents from. Often contrary to the user's
expectations and intentions and without telling the user it happened. (CVE-2021-22923)

- libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of
them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert'
into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing
wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary
depending on used file systems.The comparison also didn't include the 'issuer cert' which a transfer can
setto qualify how to verify the server certificate. (CVE-2021-22924)

- curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used
option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for
sending `NEW_ENV` variables, libcurlcould be made to pass on uninitialized data from a stack based buffer
to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-
text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing
the string provided by the application. (CVE-2021-22925)

Plugin Details

Severity: Medium

ID: 423794

Version: Revision 1.8

Type: Local

Family: Alpine Linux Local Security Checks

Published: 4/4/2025

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.73

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2021-22925

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS Score Source: CVE-2021-22922

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 7/25/2021

Reference Information

CVE: CVE-2021-22922, CVE-2021-22923, CVE-2021-22924, CVE-2021-22925

IAVA: 2021-A-0352-S

Detections

Analytics