Buy commercial curl support. We
help you work out your issues, debug your libcurl applications, use the API,
port to new platforms, add new features and more. With a team lead by the
curl founder Daniel himself.
[SECURITY ADVISORY] curl: CVE-2024-11053: netrc and redirect credential leak
- Contemporary messages sorted: [ by date ] [ by thread ] [ by subject ] [ by author ] [ by messages with attachments ]
From: Daniel Stenberg via curl-library <curl-library_at_lists.haxx.se>
Date: Wed, 11 Dec 2024 08:27:18 +0100 (CET)
netrc and redirect credential leak
==================================
Project curl Security Advisory, December 11th 2024 -
[Permalink](https://curl.se/docs/CVE-2024-11053.html)
VULNERABILITY
-------------
When asked to both use a `.netrc` file for credentials and to follow HTTP
redirects, curl could leak the password used for the first host to the
followed-to host under certain circumstances.
This flaw only manifests itself if the netrc file has an entry that matches
the redirect target hostname but the entry either omits just the password or
omits both login and password.
INFO
Date: Wed, 11 Dec 2024 08:27:18 +0100 (CET)
netrc and redirect credential leak
==================================
Project curl Security Advisory, December 11th 2024 -
[Permalink](https://curl.se/docs/CVE-2024-11053.html)
VULNERABILITY
-------------
When asked to both use a `.netrc` file for credentials and to follow HTTP
redirects, curl could leak the password used for the first host to the
followed-to host under certain circumstances.
This flaw only manifests itself if the netrc file has an entry that matches
the redirect target hostname but the entry either omits just the password or
omits both login and password.
INFO
---- A curl transfer with `a.tld` that redirects to `b.tld` that uses a `.netrc` like below (with a match, but no password specified for the second host), would make curl pass on `alicespassword` as password even in the second transfer to the separate host `b.tld`. ~~~ machine a.tld login alice password alicespassword default login bob ~~~ This bug is **not** considered a *C mistake*. It is not likely to have been avoided had we not been using C. This flaw also affects the curl command line tool. The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2024-11053 to this issue. CWE-200: Exposure of Sensitive Information to an Unauthorized Actor Severity: Low AFFECTED VERSIONS ----------------- - Affected versions: curl 6.5 to and including 8.11.0 - Not affected versions: curl < 6.5 and >= 8.11.1 - Introduced-in: https://github.com/curl/curl/commit/ae1912cb0d494b48d514 libcurl is used by many applications, but not always advertised as such! SOLUTION ------------ - Fixed-in: https://github.com/curl/curl/commit/e9b9bbac22c26cf6731 The fix also addresses a few other .netrc related issues. RECOMMENDATIONS --------------- We suggest you take one of the following actions immediately, in order of preference: A - Upgrade curl and libcurl to version 8.11.1 B - Apply the patch to your version and rebuild C - Avoid using netrc together with redirects TIMELINE --------- This issue was reported to the curl project on November 8, 2024. We contacted distros_at_openwall on December 3, 2024. curl 8.11.1 was released on December 11 2024 around 06:00 UTC, coordinated with the publication of this advisory. CREDITS ------- - Reported-by: Harry Sintonen - Patched-by: Daniel Stenberg Thanks a lot! -- / daniel.haxx.se -- Unsubscribe: https://lists.haxx.se/mailman/listinfo/curl-library Etiquette: https://curl.se/mail/etiquette.htmlReceived on 2024-12-11