CVE-2021-22898

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-22898
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-22898.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-22898
Aliases
Downstream
Related
Published
2021-06-11T16:15:11.043Z
Modified
2026-02-04T22:17:26.422381Z
Severity
  • 3.1 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N CVSS Calculator
Summary
[none]
Details

curl 7.7 through 7.76.1 suffers from an information disclosure when the -t command line option, known as CURLOPT_TELNETOPTIONS in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.

References

Affected packages

Git / github.com/mysql/mysql-server

Affected ranges

Type
GIT
Repo
https://github.com/mysql/mysql-server
Events
Introduced
ca94b993454c86be248fbe180db94647488114e9
Fixed
98b2ccb470de120d36bc4a623c814cdfded958ec
Fixed
a9b0c712de3509d8d08d3ba385d41a4df6348775

Affected versions

mysql-5.*
mysql-5.5.63
mysql-5.6.43
mysql-5.6.45
mysql-5.6.46
mysql-5.6.47
mysql-5.6.48
mysql-5.6.49
mysql-5.6.50
mysql-5.6.51
mysql-5.7.25
mysql-5.7.26
mysql-5.7.27
mysql-5.7.28
mysql-5.7.29
mysql-5.7.30
mysql-5.7.31
mysql-5.7.32
mysql-5.7.33
mysql-8.*
mysql-8.0.15
mysql-8.0.16
mysql-8.0.17
mysql-8.0.18
mysql-8.0.19
mysql-8.0.20
mysql-8.0.21
mysql-8.0.22
mysql-8.0.23
mysql-8.0.24
mysql-cluster-7.*
mysql-cluster-7.2.37
mysql-cluster-7.2.38
mysql-cluster-7.2.39
mysql-cluster-7.2.40
mysql-cluster-7.3.23
mysql-cluster-7.3.24
mysql-cluster-7.3.25
mysql-cluster-7.3.26
mysql-cluster-7.3.27
mysql-cluster-7.3.28
mysql-cluster-7.3.29
mysql-cluster-7.3.30
mysql-cluster-7.3.31
mysql-cluster-7.4.23
mysql-cluster-7.4.24
mysql-cluster-7.4.25
mysql-cluster-7.4.26
mysql-cluster-7.4.27
mysql-cluster-7.4.28
mysql-cluster-7.4.29
mysql-cluster-7.4.30
mysql-cluster-7.5.12
mysql-cluster-7.5.13
mysql-cluster-7.5.14
mysql-cluster-7.5.15
mysql-cluster-7.5.16
mysql-cluster-7.5.17
mysql-cluster-7.5.18
mysql-cluster-7.5.19
mysql-cluster-7.5.20
mysql-cluster-7.5.21
mysql-cluster-7.6.10
mysql-cluster-7.6.11
mysql-cluster-7.6.12
mysql-cluster-7.6.13
mysql-cluster-7.6.14
mysql-cluster-7.6.15
mysql-cluster-7.6.16
mysql-cluster-7.6.17
mysql-cluster-7.6.8
mysql-cluster-7.6.9
mysql-cluster-8.*
mysql-cluster-8.0.16
mysql-cluster-8.0.18
mysql-cluster-8.0.19
mysql-cluster-8.0.20
mysql-cluster-8.0.21
mysql-cluster-8.0.22
mysql-cluster-8.0.23
mysql-cluster-8.0.24

Database specific

vanir_signatures 
[
    {
        "target": {
            "file": "sql/item_sum.cc",
            "function": "Item_ntile::fix_fields"
        },
        "id": "CVE-2021-22898-3a3afa13",
        "source": "https://github.com/mysql/mysql-server/commit/98b2ccb470de120d36bc4a623c814cdfded958ec",
        "digest": {
            "length": 164.0,
            "function_hash": "151132652176240636847836380669942588961"
        },
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Function"
    },
    {
        "target": {
            "file": "sql/item_sum.h"
        },
        "id": "CVE-2021-22898-b466ba2c",
        "source": "https://github.com/mysql/mysql-server/commit/98b2ccb470de120d36bc4a623c814cdfded958ec",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "77377636987516944716339593611926856803",
                "142305612386154007679493547611883749558",
                "28963515312630878181069270734519432484",
                "189136154787345778069113967453357263064",
                "279825870249106404218276981844202046255",
                "49834063100662448344239531338010457862",
                "305324677266273514331621360994794102163",
                "291539385034554585704690285934398658292",
                "236290264454280366434563539014838479614",
                "141317470226054596320765560831766974514",
                "293246036016278744162797714460506529443",
                "122395028490668685882586271524119445319",
                "284458543644346001938693822336726309792",
                "235525345452044799367912843591411764217",
                "165750678219403994129886011648698991884"
            ]
        },
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Line"
    },
    {
        "target": {
            "file": "sql/item_sum.cc",
            "function": "Item_func_group_concat::fix_fields"
        },
        "id": "CVE-2021-22898-c1e56b4a",
        "source": "https://github.com/mysql/mysql-server/commit/98b2ccb470de120d36bc4a623c814cdfded958ec",
        "digest": {
            "length": 2099.0,
            "function_hash": "289288981748901423130195206259685444645"
        },
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Function"
    },
    {
        "target": {
            "file": "sql/item_sum.cc"
        },
        "id": "CVE-2021-22898-e0665040",
        "source": "https://github.com/mysql/mysql-server/commit/98b2ccb470de120d36bc4a623c814cdfded958ec",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "128532828239806081815173253903495399937",
                "185178342391912730906413602950301399845",
                "97073121848381340882801958057414112130",
                "21787205664934285124213972897648826910",
                "210360094889580693759307439820673316785",
                "91968359554667373632799823213263885280",
                "204786958800992693528587719972879106019",
                "336835840659383473680709084941686065983",
                "231712879563153787737540134928862224841",
                "323967078698100139790231535302074881119",
                "60799587189103250276527900071006429076",
                "141679927460555707293407627171615006659",
                "319137299000429162692642899254402106810"
            ]
        },
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Line"
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-22898.json"