Описание
Successfully using libcurl to do a transfer over a specific HTTP proxy
(proxyA) with Digest authentication and then changing the proxy host to
a second one (proxyB) for a second transfer, reusing the same handle, makes
libcurl wrongly pass on the Proxy-Authorization: header field meant for
proxyA, to proxyB.
A flaw was found in libcurl. When a user performs a transfer over an HTTP proxy using Digest authentication and then reuses the same handle for a second transfer with a different proxy host, libcurl incorrectly sends the Proxy-Authorization header intended for the first proxy to the second proxy. This could lead to the disclosure of sensitive authentication information to an unintended proxy, potentially allowing an attacker to gain unauthorized access or impersonate the user.
Отчет
Moderate: A flaw in libcurl allows for information disclosure when a client reuses a handle for HTTP proxy transfers. If a libcurl application uses Digest authentication with one proxy and then connects to a different proxy using the same handle, the Proxy-Authorization header from the initial connection may be inadvertently sent to the second proxy, potentially exposing sensitive authentication data.
Меры по смягчению последствий
To mitigate this issue, applications using libcurl should avoid reusing handles when switching between different HTTP proxies, especially after performing Digest authentication. This operational control prevents the unintended disclosure of Proxy-Authorization headers to subsequent proxy hosts.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | curl | Affected | ||
| Red Hat Enterprise Linux 6 | curl | Fix deferred | ||
| Red Hat Enterprise Linux 7 | curl | Fix deferred | ||
| Red Hat Enterprise Linux 8 | curl | Fix deferred | ||
| Red Hat Enterprise Linux 9 | curl | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | rhcos | Fix deferred | ||
| Red Hat Hardened Images | curl-main-8.20.0-2.hum1 | Fixed | RHSA-2026:19106 | 19.05.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
5.3 Medium
CVSS3
Связанные уязвимости
Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with **Digest** authentication and then changing the proxy host to a second one (`proxyB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Proxy-Authorization:` header field meant for `proxyA`, to `proxyB`.
Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with **Digest** authentication and then changing the proxy host to a second one (`proxyB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Proxy-Authorization:` header field meant for `proxyA`, to `proxyB`.
Successfully using libcurl to do a transfer over a specific HTTP proxy ...
Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with **Digest** authentication and then changing the proxy host to a second one (`proxyB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Proxy-Authorization:` header field meant for `proxyA`, to `proxyB`.
EPSS
5.3 Medium
CVSS3