REDHAT-BUG-1422464: Medium severity libcurl vulnerability
It was found that the fix for CVE-2015-3148 did not correctly backported to curl in RHEL 6 because it did not reflect the fact that the HAVEGSSAPI define was meanwhile substituted by USEHTTPNEGOTIATE.
The original issue was described as:
It was discovered that libcurl could incorrectly reuse Negotiate authenticated HTTP connections for subsequent requests. If an application using libcurl established a Negotiate authenticated HTTP connection to a server and sent subsequent requests with different credentials, the connection could be re-used with the initial set of credentials instead of using the new ones.
This issue was introduced in RHEL 6.7 and affects RHEL 6 curl only.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1422464?
The severity of REDHAT-BUG-1422464 is classified as moderate due to its potential impact on system security when using the affected version of curl.
How do I fix REDHAT-BUG-1422464?
To fix REDHAT-BUG-1422464, update to the latest version of curl provided by Red Hat for RHEL 6 that addresses this vulnerability.
What versions of curl are affected by REDHAT-BUG-1422464?
REDHAT-BUG-1422464 affects curl version 6.7 and earlier in RHEL 6.
Is REDHAT-BUG-1422464 related to CVE-2015-3148?
Yes, REDHAT-BUG-1422464 is directly related to CVE-2015-3148, as it addresses an incorrect backport of the fix for that vulnerability.
What is the nature of the vulnerability in REDHAT-BUG-1422464?
The vulnerability in REDHAT-BUG-1422464 is related to improper handling of the GSSAPI authentication mechanism in curl, which could allow for unauthorized access.