{"id":"UBUNTU-CVE-2021-38165","details":"Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because they may appear in SNI data.","modified":"2026-01-30T02:48:03.437449Z","published":"2021-08-07T18:15:00Z","related":["USN-4800-1"],"upstream":["CVE-2021-38165"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2021-38165"},{"type":"REPORT","url":"https://lists.nongnu.org/archive/html/lynx-dev/2021-08/msg00002.html"},{"type":"REPORT","url":"https://lynx.invisible-island.net/current/CHANGES.html#v2.9.0dev.9"},{"type":"REPORT","url":"https://invisible-mirror.net/archives/lynx/patches/lynx2.9.0dev.9.patch.gz"},{"type":"REPORT","url":"https://www.openwall.com/lists/oss-security/2021/08/07/1"},{"type":"REPORT","url":"https://github.com/w3c/libwww/blob/f010b4cc58d32f34b162f0084fe093f7097a61f0/Library/src/HTParse.c#L118"},{"type":"REPORT","url":"https://lynx.invisible-island.net/current/CHANGES.html"},{"type":"REPORT","url":"https://bugs.debian.org/991971"},{"type":"REPORT","url":"https://www.openwall.com/lists/oss-security/2021/08/07/11"},{"type":"REPORT","url":"http://www.openwall.com/lists/oss-security/2021/08/07/9"},{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-4800-1"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2021-38165"}],"affected":[{"package":{"name":"lynx","ecosystem":"Ubuntu:Pro:16.04:LTS","purl":"pkg:deb/ubuntu/lynx@2.8.9dev8-4ubuntu1+esm2?arch=source&distro=esm-apps/xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.9dev8-4ubuntu1+esm2"}]}],"versions":["2.8.9dev8-4ubuntu1","2.8.9dev8-4ubuntu1+esm1"],"ecosystem_specific":{"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro","binaries":[{"binary_name":"lynx","binary_version":"2.8.9dev8-4ubuntu1+esm2"},{"binary_name":"lynx-common","binary_version":"2.8.9dev8-4ubuntu1+esm2"},{"binary_name":"lynx-cur","binary_version":"2.8.9dev8-4ubuntu1+esm2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-38165.json"}},{"package":{"name":"lynx","ecosystem":"Ubuntu:Pro:18.04:LTS","purl":"pkg:deb/ubuntu/lynx@2.8.9dev16-3ubuntu0.1~esm1?arch=source&distro=esm-apps/bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.9dev16-3ubuntu0.1~esm1"}]}],"versions":["2.8.9dev16-1","2.8.9dev16-2","2.8.9dev16-3"],"ecosystem_specific":{"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro","binaries":[{"binary_name":"lynx","binary_version":"2.8.9dev16-3ubuntu0.1~esm1"},{"binary_name":"lynx-common","binary_version":"2.8.9dev16-3ubuntu0.1~esm1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-38165.json"}},{"package":{"name":"lynx","ecosystem":"Ubuntu:Pro:20.04:LTS","purl":"pkg:deb/ubuntu/lynx@2.9.0dev.5-1ubuntu0.1~esm1?arch=source&distro=esm-apps/focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0dev.5-1ubuntu0.1~esm1"}]}],"versions":["2.9.0dev.4-1","2.9.0dev.5-1"],"ecosystem_specific":{"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro","binaries":[{"binary_name":"lynx","binary_version":"2.9.0dev.5-1ubuntu0.1~esm1"},{"binary_name":"lynx-common","binary_version":"2.9.0dev.5-1ubuntu0.1~esm1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-38165.json"}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"},{"type":"Ubuntu","score":"medium"}]}