REDHAT-BUG-2496767: Medium severity curl libcurl vulnerability
Successfully using libcurl to do a transfer to a specific HTTP origin (hostA) with Digest authentication and then changing the origin to a different one (hostB) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the Authorization: header field meant for hostA, to hostB.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using libcurl are exposed only when they successfully perform a Digest-authenticated HTTP transfer to one origin and then reuse the same handle for a transfer to a different origin.
What must happen for credentials to be disclosed?
The first transfer must use Digest authentication to hostA, and the same libcurl handle must subsequently be used for a transfer to hostB. In that sequence, libcurl can send hostA's Authorization header to hostB.
How can I determine whether my application is affected?
Review whether it reuses libcurl handles across different HTTP origins after Digest-authenticated transfers. Affected behavior is indicated if a later request to a different host includes the Authorization header intended for the earlier host.