CVE-2011-2192: Medium severity libcurl vulnerability
It was found that cURL performed client credentials delegation during the client-to-server GSS security mechanisms negotiation. A remote, rogue server could use this flaw to impersonate the cURL client (victim) against the correct (originally intended) server, potentially leading to denial of cURL tool services for victim client.
Other sources
The Curlinputnegotiate function in httpnegotiate.c in libcurl 7.10.6 through 7.21.6, as used in curl and other products, always performs credential delegation during GSSAPI authentication, which allows remote servers to impersonate clients via GSSAPI requests.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-2192?
CVE-2011-2192 has been classified as a moderate severity vulnerability that could lead to impersonation of a cURL client.
How do I fix CVE-2011-2192?
To fix CVE-2011-2192, upgrade to a version of cURL that is newer than 7.21.6.
Which versions of cURL are affected by CVE-2011-2192?
CVE-2011-2192 affects cURL versions between 7.10.6 and 7.21.6 inclusive.
What systems are impacted by CVE-2011-2192?
CVE-2011-2192 affects various operating systems including specific versions of Debian, Fedora, Ubuntu, and macOS.
How can an attacker exploit CVE-2011-2192?
An attacker can exploit CVE-2011-2192 by impersonating a cURL client using a rogue server during the GSS security mechanisms negotiation.