fkie_cve-2024-11053
Vulnerability from fkie_nvd
Published
2024-12-11 08:15
Modified
2025-01-31 15:15
Severity ?
3.4 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
Summary
When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password.
References
2499f714-1537-4658-8207-48ae4bb9eae9https://curl.se/docs/CVE-2024-11053.html
2499f714-1537-4658-8207-48ae4bb9eae9https://curl.se/docs/CVE-2024-11053.json
2499f714-1537-4658-8207-48ae4bb9eae9https://hackerone.com/reports/2829063
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2024/12/11/1
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20250124-0012/
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20250131-0003/
Impacted products
Vendor Product Version


To clipboard 

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, curl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.\n\nThis flaw only manifests itself if the netrc file has an entry that matches\nthe redirect target hostname but the entry either omits just the password or\nomits both login and password."
    },
    {
      "lang": "es",
      "value": "Cuando se le pide que use un archivo `.netrc` para las credenciales y que siga las redirecciones HTTP, curl podr\u00eda filtrar la contrase\u00f1a utilizada para el primer host al host al que sigue en determinadas circunstancias. Esta falla solo se manifiesta si el archivo netrc tiene una entrada que coincide con el nombre de host de destino de la redirecci\u00f3n, pero la entrada omite solo la contrase\u00f1a u omite tanto el nombre de usuario como la contrase\u00f1a."
    }
  ],
  "id": "CVE-2024-11053",
  "lastModified": "2025-01-31T15:15:12.400",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 3.4,
          "baseSeverity": "LOW",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 1.4,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-12-11T08:15:05.307",
  "references": [
    {
      "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
      "url": "https://curl.se/docs/CVE-2024-11053.html"
    },
    {
      "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
      "url": "https://curl.se/docs/CVE-2024-11053.json"
    },
    {
      "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
      "url": "https://hackerone.com/reports/2829063"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2024/12/11/1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://security.netapp.com/advisory/ntap-20250124-0012/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://security.netapp.com/advisory/ntap-20250131-0003/"
    }
  ],
  "sourceIdentifier": "2499f714-1537-4658-8207-48ae4bb9eae9",
  "vulnStatus": "Awaiting Analysis"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.