Overview
About vulnerability
When asked to use a .netrc file for credentials and to follow HTTP
redirects, curl could leak the password used for the first host to the
followed-to host under certain circumstances.
This flaw only manifests itself if the netrc file has a default entry that
omits both login and password. A rare circumstance.
Details
- Affected product:
- AlmaLinux 9.2 ESU , Amazon Linux 2 ELS , TuxCare 9.6 ESU
- Affected packages:
- curl @ 8.3.0 (+2 more)
When asked to use a .netrc file for credentials and to follow HTTP
redirects, curl could leak the password used for the first host to the
followed-to host under certain circumstances.
This flaw only manifests itself if the netrc file has a default entry that
omits both login and password. A rare circumstance.