CVE-2018-1000007: Critical severity haxx curl vulnerability
It was found that libcurl might accidentally leak authentication data to third parties.
When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value.
Sending the same set of headers to subsequest hosts is in particular a problem for applications that pass on custom Authorization: headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request.
This bug has existed since before curl 6.0.
Other sources
libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom Authorization: headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 7.74.0-1.3+deb11u13Fixed in 7.74.0-1.3+deb11u16Fixed in 7.88.1-10+deb12u14Fixed in 7.88.1-10+deb12u5Fixed in 8.14.1-2+deb13u2Fixed in 8.18.0-2Fixed in 8.19.0~rc3-1 - Upgrade
Upgrade
redhat/curlto a version that resolves this vulnerability.Fixed in 7.58.0 - Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 7.74.0-1.3+deb11u13 - Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 7.74.0-1.3+deb11u16 - Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 7.88.1-10+deb12u14 - Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 7.88.1-10+deb12u5 - Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 8.14.1-2+deb13u2 - Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 8.18.0-2 - Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 8.19.0~rc3-1
Event History
Frequently Asked Questions
What is the severity of CVE-2018-1000007?
The severity of CVE-2018-1000007 is critical (9.8).
How does CVE-2018-1000007 accidentally leak authentication data?
CVE-2018-1000007 accidentally leaks authentication data when libcurl is asked to send custom headers and follows redirects.
Which versions of libcurl are affected by CVE-2018-1000007?
Versions 7.1 through 7.57.0 of libcurl are affected by CVE-2018-1000007.
How do I fix CVE-2018-1000007?
To fix CVE-2018-1000007, update libcurl to version 7.58.0 or higher.
Where can I find more information about CVE-2018-1000007?
You can find more information about CVE-2018-1000007 at the following references: [link1](https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1384445&action=diff), [link2](https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1384445&action=edit), [link3](https://curl.haxx.se/docs/adv_2018-b3bf.html).