PT-2003-2509 · Curl · Curl

Published 2003-08-03 · Updated 2018-10-15 · CVE-2003-1605

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions curl versions 7.0.0 through 7.10.6

Description The issue arises when curl connects to a site via an HTTP proxy using the CONNECT request. In this scenario, the user and password used for the proxy connection are also sent to the remote server. This occurs because curl sends CONNECT proxy credentials to the remote server.

Recommendations For curl versions 7.0.0 through 7.10.6, update to version 7.10.7 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-255

CWE-201

Related Identifiers

CVE-2003-1605

Affected Products

Curl

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2003-1605 · Security Note
• https://osv.dev/vulnerability/CURL-CVE-2003-1605 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2003-1605 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2003-1605 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2003-1605 · Vendor Advisory
• https://curl.haxx.se/docs/CVE-2003-1605.html · Vendor Advisory
• http://securityfocus.com/bid/8432 · Note