p PatchFirst

CVE-2024-11053

CVE-2024-11053 · netrc and redirect credential leak

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password.

CVSS 3.4 · Low · EPSS 2.0% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • curl

    Versions
    • ≥ 8.11.0, ≤ 8.11.0: Affected (semver)
    • ≥ 8.10.1, ≤ 8.10.1: Affected (semver)
    • ≥ 8.10.0, ≤ 8.10.0: Affected (semver)
    • ≥ 8.9.1, ≤ 8.9.1: Affected (semver)
    • ≥ 8.9.0, ≤ 8.9.0: Affected (semver)
    • ≥ 8.8.0, ≤ 8.8.0: Affected (semver)
    • ≥ 8.7.1, ≤ 8.7.1: Affected (semver)
    • ≥ 8.7.0, ≤ 8.7.0: Affected (semver)
    • ≥ 8.6.0, ≤ 8.6.0: Affected (semver)
    • ≥ 8.5.0, ≤ 8.5.0: Affected (semver)
    • ≥ 8.4.0, ≤ 8.4.0: Affected (semver)
    • ≥ 8.3.0, ≤ 8.3.0: Affected (semver)
    • ≥ 8.2.1, ≤ 8.2.1: Affected (semver)
    • ≥ 8.2.0, ≤ 8.2.0: Affected (semver)
    • ≥ 8.1.2, ≤ 8.1.2: Affected (semver)
    • ≥ 8.1.1, ≤ 8.1.1: Affected (semver)
    • ≥ 8.1.0, ≤ 8.1.0: Affected (semver)
    • ≥ 8.0.1, ≤ 8.0.1: Affected (semver)
    • ≥ 8.0.0, ≤ 8.0.0: Affected (semver)
    • ≥ 7.88.1, ≤ 7.88.1: Affected (semver)
    • ≥ 7.88.0, ≤ 7.88.0: Affected (semver)
    • ≥ 7.87.0, ≤ 7.87.0: Affected (semver)
    • ≥ 7.86.0, ≤ 7.86.0: Affected (semver)
    • ≥ 7.85.0, ≤ 7.85.0: Affected (semver)
    • ≥ 7.84.0, ≤ 7.84.0: Affected (semver)
    • ≥ 7.83.1, ≤ 7.83.1: Affected (semver)
    • ≥ 7.83.0, ≤ 7.83.0: Affected (semver)
    • ≥ 7.82.0, ≤ 7.82.0: Affected (semver)
    • ≥ 7.81.0, ≤ 7.81.0: Affected (semver)
    • ≥ 7.80.0, ≤ 7.80.0: Affected (semver)
    • ≥ 7.79.1, ≤ 7.79.1: Affected (semver)
    • ≥ 7.79.0, ≤ 7.79.0: Affected (semver)
    • ≥ 7.78.0, ≤ 7.78.0: Affected (semver)
    • ≥ 7.77.0, ≤ 7.77.0: Affected (semver)
    • ≥ 7.76.1, ≤ 7.76.1: Affected (semver)
    • ≥ 7.76.0, ≤ 7.76.0: Affected (semver)
    • ≥ 7.75.0, ≤ 7.75.0: Affected (semver)
    • ≥ 7.74.0, ≤ 7.74.0: Affected (semver)
    • ≥ 7.73.0, ≤ 7.73.0: Affected (semver)
    • ≥ 7.72.0, ≤ 7.72.0: Affected (semver)
    • ≥ 7.71.1, ≤ 7.71.1: Affected (semver)
    • ≥ 7.71.0, ≤ 7.71.0: Affected (semver)
    • ≥ 7.70.0, ≤ 7.70.0: Affected (semver)
    • ≥ 7.69.1, ≤ 7.69.1: Affected (semver)
    • ≥ 7.69.0, ≤ 7.69.0: Affected (semver)

    No fix published

  • curl Debian:12

    Versions
    • 7.88.1-10
    • 7.88.1-10+deb12u1
    • 7.88.1-10+deb12u1~bpo11+1
    • 7.88.1-10+deb12u2
    • 7.88.1-10+deb12u3
    • 7.88.1-10+deb12u3~bpo11+1
    • 7.88.1-10+deb12u4
    • 7.88.1-10+deb12u5
    • 7.88.1-10+deb12u5~bpo11+1
    • 7.88.1-10+deb12u6
    • 7.88.1-10+deb12u6~bpo11+1
    • 7.88.1-10+deb12u7
    • 7.88.1-10+deb12u8
    • 7.88.1-10+deb12u9
    Affected ranges
    • ECOSYSTEM: < 7.88.1-10+deb12u10

    Update to 7.88.1-10+deb12u10

  • curl Debian:13

    Affected ranges
    • ECOSYSTEM: < 8.11.1-1

    Update to 8.11.1-1

  • curl Debian:14

    Affected ranges
    • ECOSYSTEM: < 8.11.1-1

    Update to 8.11.1-1

  • curl Ubuntu:Pro:14.04:LTS

    Versions
    • 7.32.0-1ubuntu1
    • 7.33.0-1ubuntu1
    • 7.34.0-1ubuntu1
    • 7.35.0-1ubuntu1
    • 7.35.0-1ubuntu2
    • 7.35.0-1ubuntu2.1
    • 7.35.0-1ubuntu2.2
    • 7.35.0-1ubuntu2.3
    • 7.35.0-1ubuntu2.5
    • 7.35.0-1ubuntu2.6
    • 7.35.0-1ubuntu2.7
    • 7.35.0-1ubuntu2.8
    • 7.35.0-1ubuntu2.9
    • 7.35.0-1ubuntu2.10
    • 7.35.0-1ubuntu2.11
    • 7.35.0-1ubuntu2.12
    • 7.35.0-1ubuntu2.13
    • 7.35.0-1ubuntu2.14
    • 7.35.0-1ubuntu2.15
    • 7.35.0-1ubuntu2.16
    • 7.35.0-1ubuntu2.17
    • 7.35.0-1ubuntu2.19
    • 7.35.0-1ubuntu2.20
    • 7.35.0-1ubuntu2.20+esm2
    • 7.35.0-1ubuntu2.20+esm3
    • 7.35.0-1ubuntu2.20+esm4
    • 7.35.0-1ubuntu2.20+esm5
    • 7.35.0-1ubuntu2.20+esm6
    • 7.35.0-1ubuntu2.20+esm7
    • 7.35.0-1ubuntu2.20+esm8
    • 7.35.0-1ubuntu2.20+esm9
    • 7.35.0-1ubuntu2.20+esm10
    • 7.35.0-1ubuntu2.20+esm11
    • 7.35.0-1ubuntu2.20+esm12
    • 7.35.0-1ubuntu2.20+esm13
    • 7.35.0-1ubuntu2.20+esm14
    • 7.35.0-1ubuntu2.20+esm15
    • 7.35.0-1ubuntu2.20+esm16
    • 7.35.0-1ubuntu2.20+esm17
    • 7.35.0-1ubuntu2.20+esm18
    • 7.35.0-1ubuntu2.20+esm19
    • 7.35.0-1ubuntu2.20+esm20
    Affected ranges
    • ECOSYSTEM: < 7.35.0-1ubuntu2.20+esm21

    Update to 7.35.0-1ubuntu2.20+esm21

  • curl Ubuntu:Pro:16.04:LTS

    Versions
    • 7.43.0-1ubuntu2
    • 7.45.0-1ubuntu1
    • 7.46.0-1ubuntu1
    • 7.47.0-1ubuntu1
    • 7.47.0-1ubuntu2
    • 7.47.0-1ubuntu2.1
    • 7.47.0-1ubuntu2.2
    • 7.47.0-1ubuntu2.3
    • 7.47.0-1ubuntu2.4
    • 7.47.0-1ubuntu2.5
    • 7.47.0-1ubuntu2.6
    • 7.47.0-1ubuntu2.7
    • 7.47.0-1ubuntu2.8
    • 7.47.0-1ubuntu2.9
    • 7.47.0-1ubuntu2.11
    • 7.47.0-1ubuntu2.12
    • 7.47.0-1ubuntu2.13
    • 7.47.0-1ubuntu2.14
    • 7.47.0-1ubuntu2.15
    • 7.47.0-1ubuntu2.16
    • 7.47.0-1ubuntu2.18
    • 7.47.0-1ubuntu2.19
    • 7.47.0-1ubuntu2.19+esm1
    • 7.47.0-1ubuntu2.19+esm2
    • 7.47.0-1ubuntu2.19+esm3
    • 7.47.0-1ubuntu2.19+esm4
    • 7.47.0-1ubuntu2.19+esm5
    • 7.47.0-1ubuntu2.19+esm6
    • 7.47.0-1ubuntu2.19+esm7
    • 7.47.0-1ubuntu2.19+esm8
    • 7.47.0-1ubuntu2.19+esm9
    • 7.47.0-1ubuntu2.19+esm10
    • 7.47.0-1ubuntu2.19+esm11
    • 7.47.0-1ubuntu2.19+esm12
    • 7.47.0-1ubuntu2.19+esm13
    • 7.47.0-1ubuntu2.19+esm15
    • 7.47.0-1ubuntu2.19+esm16
    Affected ranges
    • ECOSYSTEM: < 7.47.0-1ubuntu2.19+esm17

    Update to 7.47.0-1ubuntu2.19+esm17

  • curl Ubuntu:Pro:18.04:LTS

    Versions
    • 7.55.1-1ubuntu2
    • 7.55.1-1ubuntu2.1
    • 7.57.0-1ubuntu1
    • 7.58.0-2ubuntu1
    • 7.58.0-2ubuntu2
    • 7.58.0-2ubuntu3
    • 7.58.0-2ubuntu3.1
    • 7.58.0-2ubuntu3.2
    • 7.58.0-2ubuntu3.3
    • 7.58.0-2ubuntu3.5
    • 7.58.0-2ubuntu3.6
    • 7.58.0-2ubuntu3.7
    • 7.58.0-2ubuntu3.8
    • 7.58.0-2ubuntu3.9
    • 7.58.0-2ubuntu3.10
    • 7.58.0-2ubuntu3.12
    • 7.58.0-2ubuntu3.13
    • 7.58.0-2ubuntu3.14
    • 7.58.0-2ubuntu3.15
    • 7.58.0-2ubuntu3.16
    • 7.58.0-2ubuntu3.17
    • 7.58.0-2ubuntu3.18
    • 7.58.0-2ubuntu3.19
    • 7.58.0-2ubuntu3.20
    • 7.58.0-2ubuntu3.21
    • 7.58.0-2ubuntu3.22
    • 7.58.0-2ubuntu3.23
    • 7.58.0-2ubuntu3.24
    • 7.58.0-2ubuntu3.24+esm1
    • 7.58.0-2ubuntu3.24+esm2
    • 7.58.0-2ubuntu3.24+esm3
    • 7.58.0-2ubuntu3.24+esm4
    • 7.58.0-2ubuntu3.24+esm5
    • 7.58.0-2ubuntu3.24+esm7
    • 7.58.0-2ubuntu3.24+esm8
    • 7.58.0-2ubuntu3.24+esm9
    Affected ranges
    • ECOSYSTEM: < 7.58.0-2ubuntu3.24+esm10

    Update to 7.58.0-2ubuntu3.24+esm10

  • curl Ubuntu:20.04:LTS

    Versions
    • 7.65.3-1ubuntu3
    • 7.65.3-1ubuntu4
    • 7.66.0-1ubuntu1
    • 7.67.0-2ubuntu1
    • 7.68.0-1ubuntu1
    • 7.68.0-1ubuntu2
    • 7.68.0-1ubuntu2.1
    • 7.68.0-1ubuntu2.2
    • 7.68.0-1ubuntu2.4
    • 7.68.0-1ubuntu2.5
    • 7.68.0-1ubuntu2.6
    • 7.68.0-1ubuntu2.7
    • 7.68.0-1ubuntu2.10
    • 7.68.0-1ubuntu2.11
    • 7.68.0-1ubuntu2.12
    • 7.68.0-1ubuntu2.13
    • 7.68.0-1ubuntu2.14
    • 7.68.0-1ubuntu2.15
    • 7.68.0-1ubuntu2.16
    • 7.68.0-1ubuntu2.18
    • 7.68.0-1ubuntu2.19
    • 7.68.0-1ubuntu2.20
    • 7.68.0-1ubuntu2.21
    • 7.68.0-1ubuntu2.22
    • 7.68.0-1ubuntu2.23
    • 7.68.0-1ubuntu2.24
    Affected ranges
    • ECOSYSTEM: < 7.68.0-1ubuntu2.25

    Update to 7.68.0-1ubuntu2.25

  • curl Ubuntu:22.04:LTS

    Versions
    • 7.74.0-1.3ubuntu2
    • 7.74.0-1.3ubuntu3
    • 7.80.0-3
    • 7.81.0-1
    • 7.81.0-1ubuntu1.1
    • 7.81.0-1ubuntu1.2
    • 7.81.0-1ubuntu1.3
    • 7.81.0-1ubuntu1.4
    • 7.81.0-1ubuntu1.6
    • 7.81.0-1ubuntu1.7
    • 7.81.0-1ubuntu1.8
    • 7.81.0-1ubuntu1.10
    • 7.81.0-1ubuntu1.11
    • 7.81.0-1ubuntu1.13
    • 7.81.0-1ubuntu1.14
    • 7.81.0-1ubuntu1.15
    • 7.81.0-1ubuntu1.16
    • 7.81.0-1ubuntu1.17
    • 7.81.0-1ubuntu1.18
    • 7.81.0-1ubuntu1.19
    Affected ranges
    • ECOSYSTEM: < 7.81.0-1ubuntu1.20

    Update to 7.81.0-1ubuntu1.20

  • curl Ubuntu:24.04:LTS

    Versions
    • 8.2.1-1ubuntu3
    • 8.2.1-1ubuntu3.1
    • 8.4.0-2ubuntu1
    • 8.5.0-2ubuntu1
    • 8.5.0-2ubuntu2
    • 8.5.0-2ubuntu8
    • 8.5.0-2ubuntu9
    • 8.5.0-2ubuntu10
    • 8.5.0-2ubuntu10.1
    • 8.5.0-2ubuntu10.2
    • 8.5.0-2ubuntu10.3
    • 8.5.0-2ubuntu10.4
    • 8.5.0-2ubuntu10.5
    Affected ranges
    • ECOSYSTEM: < 8.5.0-2ubuntu10.6

    Update to 8.5.0-2ubuntu10.6

Original sources

Check your server →