Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2018-1000007

Опубликовано: 24 янв. 2018
Источник: redhat
CVSS3: 6.5
EPSS Низкий

Описание

libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom Authorization: headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request.

It was found that curl and libcurl might send their Authentication header to a third party HTTP server upon receiving an HTTP REDIRECT reply. This could leak authentication token to external entities.

Отчет

This issue affects the versions of curl as shipped with Red Hat Enterprise Linux 5, 6, and 7, as well as the versions of httpd24-curl as shipped with Red Hat Software Collections. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Меры по смягчению последствий

By default, curl and libcurl will not follow redirect requests. This flaw happens only when curl or libcurl are explicitly requested to follow redirects (option --location in curl, and CURLOPT_FOLLOWLOCATION in libcurl). To mitigate this, it is possible to prevent the automated following of redirects, replacing it by manual redirects (and remove the authentication header), for example.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
.NET Core 1.0 on Red Hat Enterprise Linuxrh-dotnetcore10-curlOut of support scope
.NET Core 1.1 on Red Hat Enterprise Linuxrh-dotnetcore11-curlOut of support scope
.NET Core 2.0 on Red Hat Enterprise Linuxrh-dotnet20-curlOut of support scope
.NET Core 2.1 on Red Hat Enterprise Linuxrh-dotnet21-curlWill not fix
Red Hat Ceph Storage 2curlNot affected
Red Hat Enterprise Linux 5curlOut of support scope
Red Hat Enterprise Linux 6curlOut of support scope
JBoss Core Services Apache HTTP Server 2.4.29 SP2jbcs-httpd24-curlFixedRHSA-2019:154318.06.2019
Red Hat Enterprise Linux 7curlFixedRHSA-2018:315730.10.2018
Red Hat Enterprise Linux 7nss-pemFixedRHSA-2018:315730.10.2018

Показывать по

Дополнительная информация

Статус:

Moderate
Дефект:
CWE-200
https://bugzilla.redhat.com/show_bug.cgi?id=1537125curl: HTTP authentication leak in redirects

EPSS

Процентиль: 86%
0.02928
Низкий

6.5 Medium

CVSS3

Связанные уязвимости

CVSS3: 9.8
ubuntu
почти 8 лет назад

libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the `Location:` response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom `Authorization:` headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request.

CVSS3: 9.8
nvd
почти 8 лет назад

libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the `Location:` response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom `Authorization:` headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request.

CVSS3: 9.8
debian
почти 8 лет назад

libcurl 7.1 through 7.57.0 might accidentally leak authentication data ...

suse-cvrf
почти 8 лет назад

Security update for curl

suse-cvrf
почти 8 лет назад

Security update for curl

EPSS

Процентиль: 86%
0.02928
Низкий

6.5 Medium

CVSS3

Уязвимость CVE-2018-1000007