Metalink download sends credentials
Project curl Security Advisory, July 21th 2021 - Permalink
When curl is instructed to get content using the Metalink feature, and a user name and password are used to download the Metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user's expectations and intentions and without telling the user it happened.
This flaw exists only in the curl tool. libcurl is not affected.
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2021-22923 to this issue.
CWE-522: Insufficiently Protected Credentials
- Affected versions: curl 7.27.0 to and including 7.77.0
- Not affected versions: curl < 7.27.0 and curl >= 7.78.0
- Introduced-in: https://github.com/curl/curl/commit/b5fdbe848bc3d
curl has completely removed the Metalink feature as of 7.78.0. No fix for this flaw will be produced by the curl project.
The fix for earlier versions is to rebuild curl with the Metalink support switched off!
A - Upgrade curl to version 7.78.0
B - Make sure you do not use Metalink with curl
C - Disable Metalink in your build
This issue was reported to the curl project on May 30, 2021.
This advisory was posted on Jul 21, 2021.
- Reported-by: Harry Sintonen
- Patched-by: Daniel Stenberg
Thanks a lot!