The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through 7.21.6, as used in curl and other products, always performs credential delegation during GSSAPI authentication, which allows remote servers to impersonate clients via GSSAPI requests.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Addressbook | — | Apply OS X security update 2012-001Upgrade macOS to the latest version | Aug 28, 2015 | Jul 7, 2011 |
| Apple Osx Curl | — | Upgrade macOS to the latest versionApply OS X security update 2012-001 | Feb 3, 2012 | Jul 7, 2011 |
| Centos_linux | — | Upgrade curl-develUpgrade curl | Dec 1, 2016 | Jul 7, 2011 |
| Debian | — | Upgrade curl | Jul 30, 2024 | Jul 7, 2011 |
| Freebsd | — | Upgrade curlUpgrade linux-f10-curl | Dec 10, 2025 | Apr 11, 2014 |
| Gentoo Linux | — | Upgrade net-misc/curl. | Oct 30, 2017 | Jul 7, 2011 |
| Hpsmh | — | Upgrade to the latest version of HP System Management Homepage | Oct 13, 2015 | Jul 7, 2011 |
| Oracle_linux | — | Upgrade libcurl-develUpgrade libcurlUpgrade curlUpgrade curl-devel | Oct 16, 2024 | Jul 7, 2011 |
| Suse | — | Upgrade curl-openssl1Upgrade libcurl4-x86Upgrade libcurl4Upgrade libcurl4-openssl1-32bitUpgrade libcurl-develUpgrade libcurl4-32bitUpgrade curlUpgrade libcurl4-openssl1 | Dec 12, 2013 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libcurl3-nssUpgrade libcurl3Upgrade libcurl3-gnutls | Nov 8, 2024 | Jul 7, 2011 |
| Vmsa 2012 0001 | — | Upgrade VMware ESX 4.0 to build number 660575Upgrade VMware ESX 4.1 to build number 582267 | Feb 3, 2012 | Jul 7, 2011 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub