CVE-2021-22922

Name of the Vulnerable Software and Affected Versions curl (affected versions not specified)

Description The issue is related to the metalink feature in curl, which allows downloading content from multiple URLs. When a server hosting the content is breached and the file is replaced with a modified payload, curl should detect the hash mismatch after a completed download and remove the contents. However, this does not happen, and the potentially malicious content is kept on disk. The metalink XML file provides a hash to verify the contents, but a hash mismatch is only mentioned in text, and the user may not notice the message.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.