CVE-2021-22922

Name	CVE-2021-22922
Description	When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same contentfrom a set of different URLs, potentially hosted by different servers and theclient can then download the file from one or several of them. In a serial orparallel manner.If one of the servers hosting the contents has been breached and the contentsof the specific file on that server is replaced with a modified payload, curlshould detect this when the hash of the file mismatches after a completeddownload. It should remove the contents and instead try getting the contentsfrom another URL. This is not done, and instead such a hash mismatch is onlymentioned in text and the potentially malicious content is kept in the file ondisk.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
curl (PTS)	jessie, jessie (lts)	7.38.0-4+deb8u28	vulnerable
	stretch (security)	7.52.1-5+deb9u16	vulnerable
	stretch (lts), stretch	7.52.1-5+deb9u22	vulnerable
	buster, buster (lts)	7.64.0-4+deb10u10	vulnerable
	buster (security)	7.64.0-4+deb10u9	vulnerable
	bullseye	7.74.0-1.3+deb11u13	vulnerable
	bullseye (security)	7.74.0-1.3+deb11u14	vulnerable
	bookworm	7.88.1-10+deb12u8	fixed
	bookworm (security)	7.88.1-10+deb12u5	fixed
	sid, trixie	8.11.0-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
curl	source	(unstable)	7.79.1-1	unimportant

Notes

https://curl.se/docs/CVE-2021-22922.html
https://www.openwall.com/lists/oss-security/2021/07/21/1
The fix for earlier versions is to rebuild curl with the metalink support
switched off.
Metalink support not enabled in Debian builds.