REDHAT-BUG-2496769: High severity OpenSSL libcurl vulnerability
When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against proxyA using Digest auth, a subsequent transfer routed through proxyB erroneously leaks the Proxy-Authorization: header intended solely for proxyA.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments are exposed when libcurl handles are reused for sequential transfers and proxy routing is driven by environment variables. The problematic sequence requires an initial transfer through one proxy using Digest authentication followed by a transfer through a different proxy.
What information can be disclosed during exploitation?
The Proxy-Authorization header intended for the first proxy can be sent to the subsequent proxy. This affects proxy authentication state retained on the reused libcurl handle.
How can I identify whether this behavior may have occurred?
Review applications that reuse libcurl handles while using environment-variable proxy configuration. Look for sequential requests in which a Digest-authenticated transfer through one proxy is followed by routing through a different proxy.