REDHAT-BUG-2496768: High severity curl vulnerability
When a user invokes curl using a schemeless URL combined with --proto-default sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like CURLOPTSSHHOSTPUBLICKEYSHA256 and CURLOPTSSHKNOWNHOSTS. Conversely, the libcurl runtime successfully honors CURLOPTDEFAULTPROTOCOL and establishes the connection via SFTP/SCP as specified. Because the tool layer skipped the security configuration, these SSH host verification options are silently omitted, causing curl to connect to an unverified SSH remote host without throwing an error.
Affected Software
Event History
Frequently Asked Questions
What command pattern is required for this issue to occur?
The issue occurs when curl is invoked with a schemeless URL together with --proto-default set to sftp or scp. Under those conditions, libcurl uses the specified default protocol while the tool layer does not recognize the SSH-based scheme.
What security checks are skipped during an affected connection?
The SSH host verification options CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS are not initialized. As a result, curl can connect to an SSH remote host without verifying it.
Will curl report an error when it connects to an unverified host in this scenario?
No. The connection is established through SFTP or SCP, and the omitted SSH verification configuration is silent rather than producing an error.