REDHAT-BUG-2496760: Medium severity curl curl vulnerability
When asking curl to use a .netrc file to find credentials and at the same time specifying a URL with a username(without a password), like https://user@example.com/, curl could wrongly get and use the password for another user set in the .netrc file for that host if such a one exists and there is no match for the specified user.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for this issue to occur?
curl must be configured to use a .netrc file, and the requested URL must include a username but omit a password. The .netrc file must contain credentials for a different user on the same host, while lacking an entry that matches the username in the URL.
Who is exposed to unintended credential use?
Users or automation that combine .netrc-based authentication with URLs of the form https://user@example.com/ are exposed when their .netrc files store credentials for multiple users on the same host. In that situation, curl can select another user's password for the request.