Description
When asked to use a `.netrc` file for credentials **and** to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a `default` entry that omits both login and password. A rare circumstance.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
None
Availability
None
Affected products
- curl / curl8.3.0 – 8.3.0
- curl / curl8.11.0 – 8.11.0
- curl / curl8.10.1 – 8.10.1
- curl / curl8.10.0 – 8.10.0
- curl / curl8.9.1 – 8.9.1
- curl / curl8.9.0 – 8.9.0
- curl / curl8.8.0 – 8.8.0
- curl / curl8.7.1 – 8.7.1
- curl / curl8.7.0 – 8.7.0
- curl / curl8.6.0 – 8.6.0
- curl / curl8.5.0 – 8.5.0
- curl / curl8.4.0 – 8.4.0
- curl / curl8.11.1 – 8.11.1
- curl / curl8.2.1 – 8.2.1
- curl / curl8.2.0 – 8.2.0
- curl / curl8.1.2 – 8.1.2
- curl / curl8.1.1 – 8.1.1
- curl / curl8.1.0 – 8.1.0
- curl / curl8.0.1 – 8.0.1
- curl / curl8.0.0 – 8.0.0
- curl / curl7.88.1 – 7.88.1
- curl / curl7.88.0 – 7.88.0
- curl / curl7.87.0 – 7.87.0
- curl / curl7.86.0 – 7.86.0
- curl / curl7.85.0 – 7.85.0
- curl / curl7.84.0 – 7.84.0
- curl / curl7.83.1 – 7.83.1
- curl / curl7.83.0 – 7.83.0
- curl / curl7.82.0 – 7.82.0
- curl / curl7.81.0 – 7.81.0
- curl / curl7.80.0 – 7.80.0
- curl / curl7.79.1 – 7.79.1
- curl / curl7.79.0 – 7.79.0
- curl / curl7.78.0 – 7.78.0
- curl / curl7.77.0 – 7.77.0
- curl / curl7.76.1 – 7.76.1
- curl / curl7.76.0 – 7.76.0
- haxx / curl7.76.0 – 8.12.0
- NetApp / bootstrap_os
- NetApp / element_software
- NetApp / h300s_firmware
- NetApp / h410c_firmware
- NetApp / h410s_firmware
- NetApp / h500s_firmware
- NetApp / h610c_firmware
- NetApp / h610s_firmware
- NetApp / h615c_firmware
- NetApp / h700s_firmware
- NetApp / ontap9 – 9
- NetApp / ONTAP Select Deploy administration utility
- NetApp / ontap_tools9 – 9
- NetApp / solidfire_&_hci_management_node
- NetApp / solidfire_&_hci_storage_node
Updated 15m ago · 8 sources