When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Curl | Haxx | 7.16.4 (including) | 7.84.0 (excluding) |
| JBoss Core Services for RHEL 8 | RedHat | jbcs-httpd24-curl-0:7.86.0-2.el8jbcs | * |
| JBoss Core Services on RHEL 7 | RedHat | jbcs-httpd24-curl-0:7.86.0-2.el7jbcs | * |
| Red Hat Enterprise Linux 8 | RedHat | curl-0:7.61.1-22.el8_6.4 | * |
| Red Hat Enterprise Linux 9 | RedHat | curl-0:7.76.1-14.el9_0.5 | * |
| Red Hat Enterprise Linux 9 | RedHat | curl-0:7.76.1-14.el9_0.5 | * |
| Text-Only JBCS | RedHat | curl | * |
| Curl | Ubuntu | bionic | * |
| Curl | Ubuntu | devel | * |
| Curl | Ubuntu | esm-infra/xenial | * |
| Curl | Ubuntu | focal | * |
| Curl | Ubuntu | impish | * |
| Curl | Ubuntu | jammy | * |
| Curl | Ubuntu | kinetic | * |
| Curl | Ubuntu | trusty/esm | * |
| Curl | Ubuntu | upstream | * |