CVE-2024-11053: netrc and redirect credential leak

Reference Links

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-11053
• https://nvd.nist.gov/vuln/detail/CVE-2024-11053
• https://launchpad.net/bugs/cve/CVE-2024-11053
• https://security-tracker.debian.org/tracker/CVE-2024-11053
• https://ubuntu.com/security/CVE-2024-11053
• https://curl.se/docs/CVE-2024-11053.html
• https://github.com/curl/curl/commit/ae1912cb0d494b48d514d937826c9fe83ec96c4d
• https://github.com/curl/curl/commit/e9b9bbac22c26cf67316fa8e6c6b9e831af31949
• https://curl.se/docs/CVE-2024-11053.json
• https://hackerone.com/reports/2829063
• http://www.openwall.com/lists/oss-security/2024/12/11/1
• https://security.netapp.com/advisory/ntap-20250124-0012/
• https://security.netapp.com/advisory/ntap-20250131-0003/
• https://www.ibm.com/support/pages/node/7182403 (Advisory)

Parent vulnerabilities

(Appears in the following advisories)

• IBM-7182403

Frequently Asked Questions

• What is the severity of CVE-2024-11053?

  CVE-2024-11053 has been classified as a medium severity vulnerability due to the potential for credential leakage.

• How do I fix CVE-2024-11053?

  To mitigate CVE-2024-11053, upgrade curl to version 8.11.1-1 or later.

• What are the affected versions of curl for CVE-2024-11053?

  CVE-2024-11053 affects curl versions up to and including 7.88.1-10+deb12u8 and specific releases in the 7.74.x series.

• Can CVE-2024-11053 lead to unauthorized access?

  Yes, CVE-2024-11053 can lead to unauthorized access by leaking the password from a .netrc file to unintended hosts.

• Is CVE-2024-11053 specific to a particular operating system?

  CVE-2024-11053 primarily affects the Debian distribution of curl, but similar configurations may exist in other operating systems.