CVE-2024-11053
CVE-2024-11053 · netrc and redirect credential leak
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Esta página muestra una selección de datos de las fuentes. Consulte los avisos enlazados para ver la descripción completa y las versiones afectadas.
When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password.
CVSS 3.4 · Baja · EPSS 2,0% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: system
Productos y versiones afectados
curl
- Versiones
- ≥ 8.11.0, ≤ 8.11.0: Afectada (semver)
- ≥ 8.10.1, ≤ 8.10.1: Afectada (semver)
- ≥ 8.10.0, ≤ 8.10.0: Afectada (semver)
- ≥ 8.9.1, ≤ 8.9.1: Afectada (semver)
- ≥ 8.9.0, ≤ 8.9.0: Afectada (semver)
- ≥ 8.8.0, ≤ 8.8.0: Afectada (semver)
- ≥ 8.7.1, ≤ 8.7.1: Afectada (semver)
- ≥ 8.7.0, ≤ 8.7.0: Afectada (semver)
- ≥ 8.6.0, ≤ 8.6.0: Afectada (semver)
- ≥ 8.5.0, ≤ 8.5.0: Afectada (semver)
- ≥ 8.4.0, ≤ 8.4.0: Afectada (semver)
- ≥ 8.3.0, ≤ 8.3.0: Afectada (semver)
- ≥ 8.2.1, ≤ 8.2.1: Afectada (semver)
- ≥ 8.2.0, ≤ 8.2.0: Afectada (semver)
- ≥ 8.1.2, ≤ 8.1.2: Afectada (semver)
- ≥ 8.1.1, ≤ 8.1.1: Afectada (semver)
- ≥ 8.1.0, ≤ 8.1.0: Afectada (semver)
- ≥ 8.0.1, ≤ 8.0.1: Afectada (semver)
- ≥ 8.0.0, ≤ 8.0.0: Afectada (semver)
- ≥ 7.88.1, ≤ 7.88.1: Afectada (semver)
- ≥ 7.88.0, ≤ 7.88.0: Afectada (semver)
- ≥ 7.87.0, ≤ 7.87.0: Afectada (semver)
- ≥ 7.86.0, ≤ 7.86.0: Afectada (semver)
- ≥ 7.85.0, ≤ 7.85.0: Afectada (semver)
- ≥ 7.84.0, ≤ 7.84.0: Afectada (semver)
- ≥ 7.83.1, ≤ 7.83.1: Afectada (semver)
- ≥ 7.83.0, ≤ 7.83.0: Afectada (semver)
- ≥ 7.82.0, ≤ 7.82.0: Afectada (semver)
- ≥ 7.81.0, ≤ 7.81.0: Afectada (semver)
- ≥ 7.80.0, ≤ 7.80.0: Afectada (semver)
- ≥ 7.79.1, ≤ 7.79.1: Afectada (semver)
- ≥ 7.79.0, ≤ 7.79.0: Afectada (semver)
- ≥ 7.78.0, ≤ 7.78.0: Afectada (semver)
- ≥ 7.77.0, ≤ 7.77.0: Afectada (semver)
- ≥ 7.76.1, ≤ 7.76.1: Afectada (semver)
- ≥ 7.76.0, ≤ 7.76.0: Afectada (semver)
- ≥ 7.75.0, ≤ 7.75.0: Afectada (semver)
- ≥ 7.74.0, ≤ 7.74.0: Afectada (semver)
- ≥ 7.73.0, ≤ 7.73.0: Afectada (semver)
- ≥ 7.72.0, ≤ 7.72.0: Afectada (semver)
- ≥ 7.71.1, ≤ 7.71.1: Afectada (semver)
- ≥ 7.71.0, ≤ 7.71.0: Afectada (semver)
- ≥ 7.70.0, ≤ 7.70.0: Afectada (semver)
- ≥ 7.69.1, ≤ 7.69.1: Afectada (semver)
- ≥ 7.69.0, ≤ 7.69.0: Afectada (semver)
Sin corrección publicada
curl Debian:12
- Versiones
- 7.88.1-10
- 7.88.1-10+deb12u1
- 7.88.1-10+deb12u1~bpo11+1
- 7.88.1-10+deb12u2
- 7.88.1-10+deb12u3
- 7.88.1-10+deb12u3~bpo11+1
- 7.88.1-10+deb12u4
- 7.88.1-10+deb12u5
- 7.88.1-10+deb12u5~bpo11+1
- 7.88.1-10+deb12u6
- 7.88.1-10+deb12u6~bpo11+1
- 7.88.1-10+deb12u7
- 7.88.1-10+deb12u8
- 7.88.1-10+deb12u9
- Intervalos de versiones afectados
- ECOSYSTEM: < 7.88.1-10+deb12u10
Actualiza a 7.88.1-10+deb12u10
curl Debian:13
- Intervalos de versiones afectados
- ECOSYSTEM: < 8.11.1-1
Actualiza a 8.11.1-1
curl Debian:14
- Intervalos de versiones afectados
- ECOSYSTEM: < 8.11.1-1
Actualiza a 8.11.1-1
curl Ubuntu:Pro:14.04:LTS
- Versiones
- 7.32.0-1ubuntu1
- 7.33.0-1ubuntu1
- 7.34.0-1ubuntu1
- 7.35.0-1ubuntu1
- 7.35.0-1ubuntu2
- 7.35.0-1ubuntu2.1
- 7.35.0-1ubuntu2.2
- 7.35.0-1ubuntu2.3
- 7.35.0-1ubuntu2.5
- 7.35.0-1ubuntu2.6
- 7.35.0-1ubuntu2.7
- 7.35.0-1ubuntu2.8
- 7.35.0-1ubuntu2.9
- 7.35.0-1ubuntu2.10
- 7.35.0-1ubuntu2.11
- 7.35.0-1ubuntu2.12
- 7.35.0-1ubuntu2.13
- 7.35.0-1ubuntu2.14
- 7.35.0-1ubuntu2.15
- 7.35.0-1ubuntu2.16
- 7.35.0-1ubuntu2.17
- 7.35.0-1ubuntu2.19
- 7.35.0-1ubuntu2.20
- 7.35.0-1ubuntu2.20+esm2
- 7.35.0-1ubuntu2.20+esm3
- 7.35.0-1ubuntu2.20+esm4
- 7.35.0-1ubuntu2.20+esm5
- 7.35.0-1ubuntu2.20+esm6
- 7.35.0-1ubuntu2.20+esm7
- 7.35.0-1ubuntu2.20+esm8
- 7.35.0-1ubuntu2.20+esm9
- 7.35.0-1ubuntu2.20+esm10
- 7.35.0-1ubuntu2.20+esm11
- 7.35.0-1ubuntu2.20+esm12
- 7.35.0-1ubuntu2.20+esm13
- 7.35.0-1ubuntu2.20+esm14
- 7.35.0-1ubuntu2.20+esm15
- 7.35.0-1ubuntu2.20+esm16
- 7.35.0-1ubuntu2.20+esm17
- 7.35.0-1ubuntu2.20+esm18
- 7.35.0-1ubuntu2.20+esm19
- 7.35.0-1ubuntu2.20+esm20
- Intervalos de versiones afectados
- ECOSYSTEM: < 7.35.0-1ubuntu2.20+esm21
Actualiza a 7.35.0-1ubuntu2.20+esm21
curl Ubuntu:Pro:16.04:LTS
- Versiones
- 7.43.0-1ubuntu2
- 7.45.0-1ubuntu1
- 7.46.0-1ubuntu1
- 7.47.0-1ubuntu1
- 7.47.0-1ubuntu2
- 7.47.0-1ubuntu2.1
- 7.47.0-1ubuntu2.2
- 7.47.0-1ubuntu2.3
- 7.47.0-1ubuntu2.4
- 7.47.0-1ubuntu2.5
- 7.47.0-1ubuntu2.6
- 7.47.0-1ubuntu2.7
- 7.47.0-1ubuntu2.8
- 7.47.0-1ubuntu2.9
- 7.47.0-1ubuntu2.11
- 7.47.0-1ubuntu2.12
- 7.47.0-1ubuntu2.13
- 7.47.0-1ubuntu2.14
- 7.47.0-1ubuntu2.15
- 7.47.0-1ubuntu2.16
- 7.47.0-1ubuntu2.18
- 7.47.0-1ubuntu2.19
- 7.47.0-1ubuntu2.19+esm1
- 7.47.0-1ubuntu2.19+esm2
- 7.47.0-1ubuntu2.19+esm3
- 7.47.0-1ubuntu2.19+esm4
- 7.47.0-1ubuntu2.19+esm5
- 7.47.0-1ubuntu2.19+esm6
- 7.47.0-1ubuntu2.19+esm7
- 7.47.0-1ubuntu2.19+esm8
- 7.47.0-1ubuntu2.19+esm9
- 7.47.0-1ubuntu2.19+esm10
- 7.47.0-1ubuntu2.19+esm11
- 7.47.0-1ubuntu2.19+esm12
- 7.47.0-1ubuntu2.19+esm13
- 7.47.0-1ubuntu2.19+esm15
- 7.47.0-1ubuntu2.19+esm16
- Intervalos de versiones afectados
- ECOSYSTEM: < 7.47.0-1ubuntu2.19+esm17
Actualiza a 7.47.0-1ubuntu2.19+esm17
curl Ubuntu:Pro:18.04:LTS
- Versiones
- 7.55.1-1ubuntu2
- 7.55.1-1ubuntu2.1
- 7.57.0-1ubuntu1
- 7.58.0-2ubuntu1
- 7.58.0-2ubuntu2
- 7.58.0-2ubuntu3
- 7.58.0-2ubuntu3.1
- 7.58.0-2ubuntu3.2
- 7.58.0-2ubuntu3.3
- 7.58.0-2ubuntu3.5
- 7.58.0-2ubuntu3.6
- 7.58.0-2ubuntu3.7
- 7.58.0-2ubuntu3.8
- 7.58.0-2ubuntu3.9
- 7.58.0-2ubuntu3.10
- 7.58.0-2ubuntu3.12
- 7.58.0-2ubuntu3.13
- 7.58.0-2ubuntu3.14
- 7.58.0-2ubuntu3.15
- 7.58.0-2ubuntu3.16
- 7.58.0-2ubuntu3.17
- 7.58.0-2ubuntu3.18
- 7.58.0-2ubuntu3.19
- 7.58.0-2ubuntu3.20
- 7.58.0-2ubuntu3.21
- 7.58.0-2ubuntu3.22
- 7.58.0-2ubuntu3.23
- 7.58.0-2ubuntu3.24
- 7.58.0-2ubuntu3.24+esm1
- 7.58.0-2ubuntu3.24+esm2
- 7.58.0-2ubuntu3.24+esm3
- 7.58.0-2ubuntu3.24+esm4
- 7.58.0-2ubuntu3.24+esm5
- 7.58.0-2ubuntu3.24+esm7
- 7.58.0-2ubuntu3.24+esm8
- 7.58.0-2ubuntu3.24+esm9
- Intervalos de versiones afectados
- ECOSYSTEM: < 7.58.0-2ubuntu3.24+esm10
Actualiza a 7.58.0-2ubuntu3.24+esm10
curl Ubuntu:20.04:LTS
- Versiones
- 7.65.3-1ubuntu3
- 7.65.3-1ubuntu4
- 7.66.0-1ubuntu1
- 7.67.0-2ubuntu1
- 7.68.0-1ubuntu1
- 7.68.0-1ubuntu2
- 7.68.0-1ubuntu2.1
- 7.68.0-1ubuntu2.2
- 7.68.0-1ubuntu2.4
- 7.68.0-1ubuntu2.5
- 7.68.0-1ubuntu2.6
- 7.68.0-1ubuntu2.7
- 7.68.0-1ubuntu2.10
- 7.68.0-1ubuntu2.11
- 7.68.0-1ubuntu2.12
- 7.68.0-1ubuntu2.13
- 7.68.0-1ubuntu2.14
- 7.68.0-1ubuntu2.15
- 7.68.0-1ubuntu2.16
- 7.68.0-1ubuntu2.18
- 7.68.0-1ubuntu2.19
- 7.68.0-1ubuntu2.20
- 7.68.0-1ubuntu2.21
- 7.68.0-1ubuntu2.22
- 7.68.0-1ubuntu2.23
- 7.68.0-1ubuntu2.24
- Intervalos de versiones afectados
- ECOSYSTEM: < 7.68.0-1ubuntu2.25
Actualiza a 7.68.0-1ubuntu2.25
curl Ubuntu:22.04:LTS
- Versiones
- 7.74.0-1.3ubuntu2
- 7.74.0-1.3ubuntu3
- 7.80.0-3
- 7.81.0-1
- 7.81.0-1ubuntu1.1
- 7.81.0-1ubuntu1.2
- 7.81.0-1ubuntu1.3
- 7.81.0-1ubuntu1.4
- 7.81.0-1ubuntu1.6
- 7.81.0-1ubuntu1.7
- 7.81.0-1ubuntu1.8
- 7.81.0-1ubuntu1.10
- 7.81.0-1ubuntu1.11
- 7.81.0-1ubuntu1.13
- 7.81.0-1ubuntu1.14
- 7.81.0-1ubuntu1.15
- 7.81.0-1ubuntu1.16
- 7.81.0-1ubuntu1.17
- 7.81.0-1ubuntu1.18
- 7.81.0-1ubuntu1.19
- Intervalos de versiones afectados
- ECOSYSTEM: < 7.81.0-1ubuntu1.20
Actualiza a 7.81.0-1ubuntu1.20
curl Ubuntu:24.04:LTS
- Versiones
- 8.2.1-1ubuntu3
- 8.2.1-1ubuntu3.1
- 8.4.0-2ubuntu1
- 8.5.0-2ubuntu1
- 8.5.0-2ubuntu2
- 8.5.0-2ubuntu8
- 8.5.0-2ubuntu9
- 8.5.0-2ubuntu10
- 8.5.0-2ubuntu10.1
- 8.5.0-2ubuntu10.2
- 8.5.0-2ubuntu10.3
- 8.5.0-2ubuntu10.4
- 8.5.0-2ubuntu10.5
- Intervalos de versiones afectados
- ECOSYSTEM: < 8.5.0-2ubuntu10.6
Actualiza a 8.5.0-2ubuntu10.6
Fuentes originales
- https://curl.se/docs/CVE-2024-11053.json
- https://curl.se/docs/CVE-2024-11053.html
- https://hackerone.com/reports/2829063
- http://www.openwall.com/lists/oss-security/2024/12/11/1
- https://security.netapp.com/advisory/ntap-20250124-0012/
- https://security.netapp.com/advisory/ntap-20250131-0003/
- https://security.netapp.com/advisory/ntap-20250131-0004/
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://cert-portal.siemens.com/productcert/html/ssa-212953.html
- https://cert-portal.siemens.com/productcert/html/ssa-089022.html
- https://nvd.nist.gov/vuln/detail/CVE-2024-11053