Alerts This Week
Warning Icon 1 914
Alerts This Week
Warning Icon 1 914

Mageia 9: MGASA-2024-0391 critical: curl password leak during redirect

mageia
Calendar Grey December 17, 2024
Dist Mageia Esm H88
Mageia's recent curl package updates address a severe security vulnerability involving password exposure during HTTP redirection, ensuring better protection for users.
When asked to both use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circum...

Summary

When asked to both use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password. This update fixes this logic to avoid sending a password to the wrong host.

References

- https://bugs.mageia.org/show_bug.cgi?id=33844

- https://curl.se/docs/CVE-2024-11053.html

- https://www.cve.org/CVERecord?id=CVE-2024-11053

Topics%20covered

Topics Covered

security advisory security issue update curl password leak mageia HTTP redirect

Resolution

SRPMS

- 9/core/curl-7.88.1-4.5.mga9

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 17 Dec 2024
URL: https://advisories.mageia.org/MGASA-2024-0391.html
Type: security
CVE: CVE-2024-11053

Topics%20covered

Topics Covered

security advisory security issue update curl password leak mageia HTTP redirect

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here