A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number.
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Curl | Haxx | * | 7.83.0 (excluding) |
| Red Hat Enterprise Linux 8 | RedHat | curl-0:7.61.1-22.el8_6.3 | * |
| Red Hat Enterprise Linux 9 | RedHat | curl-0:7.76.1-14.el9_0.4 | * |
| Red Hat Enterprise Linux 9 | RedHat | curl-0:7.76.1-14.el9_0.4 | * |
| Curl | Ubuntu | bionic | * |
| Curl | Ubuntu | devel | * |
| Curl | Ubuntu | esm-infra-legacy/trusty | * |
| Curl | Ubuntu | esm-infra/xenial | * |
| Curl | Ubuntu | focal | * |
| Curl | Ubuntu | impish | * |
| Curl | Ubuntu | jammy | * |
| Curl | Ubuntu | trusty/esm | * |
| Curl | Ubuntu | upstream | * |