PT-2015-6113 · Curl+1 · Libcurl+2
Kamil Dudka
+1
·
Published
2015-06-17
·
Updated
2024-06-15
·
CVE-2015-3236
CVSS v2.0
5.0
Medium
| Vector | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
cURL and libcurl versions 7.40.0 through 7.42.1
Description
The issue allows remote attackers to obtain sensitive information via unspecified vectors. This occurs when cURL and libcurl send the HTTP Basic authentication credentials for a previous connection when reusing a reset connection handle to send a request to the same host name. libcurl can wrongly send HTTP credentials when re-using connections, specifically when using the
curl easy reset() function, which is supposed to clear the credentials but does not. This can lead to credentials being leaked in subsequent requests to the same hostname.Recommendations
For versions 7.40.0 through 7.42.1, consider disabling the use of
curl easy reset() until a patch is available, and avoid reusing connection handles for requests to the same hostname after authentication has been used. Restrict access to sensitive resources to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Curl
Libcurl