MGASA-2024-0391

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2024-0391.html
Import Source
https://advisories.mageia.org/MGASA-2024-0391.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2024-0391
Related
Published
2024-12-17T19:42:28Z
Modified
2024-12-17T19:15:35Z
Summary
Updated curl packages fix security vulnerability
Details

When asked to both use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password. This update fixes this logic to avoid sending a password to the wrong host.

References
Credits

Affected packages

Mageia:9 / curl

Package

Name
curl
Purl
pkg:rpm/mageia/curl?distro=mageia-9

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
7.88.1-4.5.mga9

Ecosystem specific 

{
    "section": "core"
}