The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the domain of a URL.
CVSS Details
- CVSS 3.1 Base Score: 8.2
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade curl | Aug 30, 2017 | Apr 29, 2013 |
| Apple Osx Curl | — | Upgrade macOS to the latest version | Apr 5, 2017 | Apr 29, 2013 |
| Centos_linux | — | Upgrade libcurlUpgrade curl-develUpgrade libcurl-develUpgrade curl | Dec 1, 2016 | Apr 29, 2013 |
| Debian | — | Upgrade curl | Jul 30, 2024 | Apr 29, 2013 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Nov 27, 2014 |
| Gentoo Linux | — | Upgrade net-misc/curl. | Oct 30, 2017 | Apr 29, 2013 |
| Oracle Solaris | — | Upgrade web/curl to version 7.21.2-0.175.1.18.0.3.0 on Solaris 11.1 | May 29, 2017 | Apr 29, 2013 |
| Oracle_linux | — | Upgrade curl-develUpgrade libcurl-develUpgrade curlUpgrade libcurl | Oct 16, 2024 | Apr 29, 2013 |
| Suse | — | Upgrade curlUpgrade curl-32bitUpgrade curl-x86Upgrade libcurl4-debuginfo-x86Upgrade compat-curl2-64bitUpgrade sle-sdk-releaseUpgrade libcurl4-debuginfoUpgrade libcurl4-32bitUpgrade curl-develUpgrade libcurl4Upgrade compat-curl2Upgrade compat-curl2-32bitUpgrade libcurl-develUpgrade curl-debuginfoUpgrade libcurl4-debuginfo-32bitUpgrade libcurl4-x86Upgrade compat-curl2-x86Upgrade curl-64bit | Dec 12, 2013 | Apr 29, 2013 |
| Ubuntu | — | Upgrade curlUpgrade libcurl3 | Nov 8, 2024 | Apr 29, 2013 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 29, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub