The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through 7.21.6, as used in curl and other products, always performs credential delegation during GSSAPI authentication, which allows remote servers to impersonate clients via GSSAPI requests.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Addressbook | — | Apply OS X security update 2012-001Upgrade macOS to the latest version | Aug 28, 2015 | Jul 7, 2011 |
| Apple Osx Curl | — | Apply OS X security update 2012-001Upgrade macOS to the latest version | Feb 3, 2012 | Jul 7, 2011 |
| Centos_linux | — | Upgrade curlUpgrade curl-devel | Dec 1, 2016 | Jul 7, 2011 |
| Debian | — | Upgrade curl | Jul 30, 2024 | Jul 7, 2011 |
| Freebsd | — | Upgrade linux-f10-curlUpgrade curl | Dec 10, 2025 | Apr 11, 2014 |
| Gentoo Linux | — | Upgrade net-misc/curl. | Oct 30, 2017 | Jul 7, 2011 |
| Hpsmh | — | Upgrade to the latest version of HP System Management Homepage | Oct 13, 2015 | Jul 7, 2011 |
| Oracle_linux | — | Upgrade curl-develUpgrade libcurl-develUpgrade curlUpgrade libcurl | Oct 16, 2024 | Jul 7, 2011 |
| Suse | — | Upgrade libcurl4Upgrade libcurl4-x86Upgrade curl-openssl1Upgrade libcurl4-openssl1-32bitUpgrade libcurl4-openssl1Upgrade libcurl-develUpgrade curlUpgrade libcurl4-32bit | Dec 12, 2013 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libcurl3-gnutlsUpgrade libcurl3Upgrade libcurl3-nss | Nov 8, 2024 | Jul 7, 2011 |
| Vmsa 2012 0001 | — | Upgrade VMware ESX 4.1 to build number 582267Upgrade VMware ESX 4.0 to build number 660575 | Feb 3, 2012 | Jul 7, 2011 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub