The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the domain of a URL.
CVSS Details
- CVSS 3.1 Base Score: 8.2
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade curl | Aug 30, 2017 | Apr 29, 2013 |
| Apple Osx Curl | — | Upgrade macOS to the latest version | Apr 5, 2017 | Apr 29, 2013 |
| Centos_linux | — | Upgrade curl-develUpgrade libcurlUpgrade libcurl-develUpgrade curl | Dec 1, 2016 | Apr 29, 2013 |
| Debian | — | Upgrade curl | Jul 30, 2024 | Apr 29, 2013 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Nov 27, 2014 |
| Gentoo Linux | — | Upgrade net-misc/curl. | Oct 30, 2017 | Apr 29, 2013 |
| Oracle Solaris | — | Upgrade web/curl to version 7.21.2-0.175.1.18.0.3.0 on Solaris 11.1 | May 29, 2017 | Apr 29, 2013 |
| Oracle_linux | — | Upgrade curl-develUpgrade libcurlUpgrade libcurl-develUpgrade curl | Oct 16, 2024 | Apr 29, 2013 |
| Suse | — | Upgrade curl-64bitUpgrade libcurl4-debuginfo-32bitUpgrade libcurl4-x86Upgrade curl-debuginfoUpgrade compat-curl2-x86Upgrade libcurl-develUpgrade compat-curl2Upgrade compat-curl2-32bitUpgrade libcurl4Upgrade sle-sdk-releaseUpgrade curl-develUpgrade curlUpgrade curl-32bitUpgrade libcurl4-32bitUpgrade compat-curl2-64bitUpgrade libcurl4-debuginfo-x86Upgrade libcurl4-debuginfoUpgrade curl-x86 | Dec 12, 2013 | Apr 29, 2013 |
| Ubuntu | — | Upgrade curlUpgrade libcurl3 | Nov 8, 2024 | Apr 29, 2013 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 29, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub