CVE-2024-11053 Information
Description
When asked to both use a .netrc file for credentials and to follow HTTP
redirects curl could leak the password used for the first host to the
followed-to host under certain circumstances.
This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password.
Reference
cve@curl.se
http://www.openwall.com/lists/oss-security/2024/12/11/1
https://curl.se/docs/CVE-2024-11053.html
https://curl.se/docs/CVE-2024-11053.json
https://hackerone.com/reports/2829063
When
asked
to
both
use
a
.netrc
file
for
credentials
and
to
follow
HTTP
redirects
curl
could
leak
the
password
used
for
the
first
host
to
the
followed-to
host
under
certain
circumstances.
This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password.
Share on: