REDHAT-BUG-2446450: Medium severity curl curl vulnerability
When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances.
If the hostname that the first request is redirected to has information in the used .netrc file, with either of the machine or default keywords, curl would pass on the bearer token set for the first host also to the second one.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for the bearer token to be sent to another host?
An HTTP(S) transfer using an OAuth2 bearer token must redirect to a second URL. The second hostname must have matching information in the .netrc file through either a machine entry or a default entry.
Are .netrc default entries relevant, or only per-host machine entries?
Both are relevant. The token can be passed to the redirected hostname when the .netrc file contains either a machine entry for that host or a default entry.
How can I assess whether a transfer may be affected?
Identify curl HTTP(S) transfers that use OAuth2 bearer tokens and follow redirects to a different hostname. Check whether the .netrc file used by those transfers contains a machine or default entry that applies to the redirected hostname.