PT-2003-2509 · Curl · Curl

Publicado 2003-08-03 · Atualizado 2018-10-15 · CVE-2003-1605

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions curl versions 7.0.0 through 7.10.6

Description The issue arises when curl connects to a site via an HTTP proxy using the CONNECT request. In this scenario, the user and password used for the proxy connection are also sent to the remote server. This occurs because curl sends CONNECT proxy credentials to the remote server.

Recommendations For curl versions 7.0.0 through 7.10.6, update to version 7.10.7 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-255

CWE-201

Identificadores relacionados

CVE-2003-1605

Produtos afetados

Curl

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2003-1605 · Nota de Segurança
• https://osv.dev/vulnerability/CURL-CVE-2003-1605 · Aviso do Fabricante
• http://securityfocus.com/bid/8432 · Nota
• https://security-tracker.debian.org/tracker/CVE-2003-1605 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2003-1605 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2003-1605 · Aviso do Fabricante
• https://curl.haxx.se/docs/CVE-2003-1605.html · Aviso do Fabricante