An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers.
CVSS Details
- CVSS 3.1 Base Score: 5.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-curlalma-upgrade-libcurlalma-upgrade-libcurl-develalma-upgrade-libcurl-minimal | Jul 26, 2022 | Jun 2, 2022 | |
| Alpine Linux | alpine-linux-upgrade-curl | Mar 26, 2024 | Jun 1, 2022 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-curlamazon-linux-ami-2-upgrade-curl-debuginfoamazon-linux-ami-2-upgrade-libcurlamazon-linux-ami-2-upgrade-libcurl-devel | Jul 4, 2022 | Jun 2, 2022 | |
| Amazon_linux | — | amazon-linux-upgrade-curl | Dec 10, 2022 | Apr 28, 2022 |
| Amazon_linux_2023 | amazon-linux-2023-upgrade-curlamazon-linux-2023-upgrade-curl-debuginfoamazon-linux-2023-upgrade-curl-debugsourceamazon-linux-2023-upgrade-curl-minimalamazon-linux-2023-upgrade-curl-minimal-debuginfoamazon-linux-2023-upgrade-libcurlamazon-linux-2023-upgrade-libcurl-debuginfoamazon-linux-2023-upgrade-libcurl-develamazon-linux-2023-upgrade-libcurl-minimalamazon-linux-2023-upgrade-libcurl-minimal-debuginfo | Feb 17, 2025 | Apr 27, 2022 | |
| Centos_linux | — | centos-upgrade-curlcentos-upgrade-curl-debuginfocentos-upgrade-curl-debugsourcecentos-upgrade-curl-minimalcentos-upgrade-curl-minimal-debuginfocentos-upgrade-libcurlcentos-upgrade-libcurl-debuginfocentos-upgrade-libcurl-develcentos-upgrade-libcurl-minimalcentos-upgrade-libcurl-minimal-debuginfo | Jul 5, 2022 | Jun 2, 2022 |
| Debian | debian-upgrade-curl | Nov 4, 2022 | Jun 2, 2022 | |
| Freebsd | freebsd-upgrade-package-curl | Nov 4, 2022 | Apr 28, 2022 | |
| Gentoo Linux | gentoo-linux-upgrade-net-misc-curl | Dec 19, 2022 | Jun 2, 2022 | |
| Huawei Euleros 2_0_sp10 | huawei-euleros-2_0_sp10-upgrade-curlhuawei-euleros-2_0_sp10-upgrade-libcurl | Aug 2, 2022 | Jun 2, 2022 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-curlhuawei-euleros-2_0_sp8-upgrade-libcurlhuawei-euleros-2_0_sp8-upgrade-libcurl-devel | Oct 11, 2022 | Jun 2, 2022 | |
| Huawei Euleros 2_0_sp9 | huawei-euleros-2_0_sp9-upgrade-curlhuawei-euleros-2_0_sp9-upgrade-libcurl | Jul 11, 2022 | Jun 2, 2022 | |
| Oracle_linux | — | oracle-linux-upgrade-curloracle-linux-upgrade-curl-minimaloracle-linux-upgrade-libcurloracle-linux-upgrade-libcurl-develoracle-linux-upgrade-libcurl-minimal | Jun 30, 2022 | Apr 27, 2022 |
| Redhat_linux | no-fix-redhat-rpm-packageredhat-upgrade-curlredhat-upgrade-curl-debuginforedhat-upgrade-curl-debugsourceredhat-upgrade-curl-minimalredhat-upgrade-curl-minimal-debuginforedhat-upgrade-libcurlredhat-upgrade-libcurl-debuginforedhat-upgrade-libcurl-develredhat-upgrade-libcurl-minimalredhat-upgrade-libcurl-minimal-debuginfo | Jul 5, 2022 | Jun 2, 2022 | |
| Rocky_linux | rocky-upgrade-curlrocky-upgrade-curl-debuginforocky-upgrade-curl-debugsourcerocky-upgrade-libcurlrocky-upgrade-libcurl-debuginforocky-upgrade-libcurl-develrocky-upgrade-libcurl-minimalrocky-upgrade-libcurl-minimal-debuginfo | Jul 11, 2022 | Jun 2, 2022 | |
| Splunk | splunk-upgrade-latest | Sep 30, 2025 | Jun 1, 2022 | |
| Suse | — | suse-upgrade-curlsuse-upgrade-libcurl-develsuse-upgrade-libcurl4suse-upgrade-libcurl4-32bit | Oct 26, 2022 | Jun 2, 2022 |
| Ubuntu | ubuntu-upgrade-curlubuntu-upgrade-libcurl3-gnutlsubuntu-upgrade-libcurl3-nssubuntu-upgrade-libcurl4 | Apr 29, 2022 | Apr 28, 2022 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Jun 1, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub