libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different services.
libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead.
When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services.
Weakness
The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Curl | Haxx | 7.46.0 (including) | 8.20.0 (excluding) |
| Red Hat Enterprise Linux 10 | RedHat | curl-0:8.12.1-4.el10_2.6 | * |
| Red Hat Enterprise Linux 10.0 Extended Update Support | RedHat | curl-0:8.12.1-1.el10_0.10 | * |
| Red Hat Enterprise Linux 9 | RedHat | curl-0:7.76.1-40.el9_8.7 | * |
| Red Hat Enterprise Linux 9 | RedHat | curl-0:7.76.1-40.el9_8.7 | * |
| Cert Manager support for Red Hat OpenShift release 1.20 | RedHat | cert-manager/jetstack-cert-manager-rhel9:1790223279 | * |
| Cert Manager support for Red Hat OpenShift release 1.20 | RedHat | cert-manager/cert-manager-istio-csr-rhel9:1790223719 | * |
| Cert Manager support for Red Hat OpenShift release 1.20 | RedHat | cert-manager/cert-manager-operator-rhel9:1790272426 | * |
| Cert Manager support for Red Hat OpenShift release 1.20 | RedHat | cert-manager/jetstack-cert-manager-acmesolver-rhel9:1790589998 | * |
| Cert Manager support for Red Hat OpenShift release 1.20 | RedHat | cert-manager/jetstack-cert-manager-rhel9:1790589912 | * |
| Cert Manager support for Red Hat OpenShift release 1.20 | RedHat | cert-manager/cert-manager-istio-csr-rhel9:1790589914 | * |
| Cert Manager support for Red Hat OpenShift release 1.20 | RedHat | cert-manager/cert-manager-operator-rhel9:1790589855 | * |
| Red Hat Hardened Images | RedHat | curl-main-8.21.0-0.1.hum1 | * |
| Red Hat Hardened Images | RedHat | rust-main-1.96.1-1.hum1 | * |
| Red Hat OpenShift Dev Spaces 3.30 | RedHat | devspaces/code-rhel9:1790619703 | * |
| Red Hat Update Infrastructure 5 | RedHat | rhui5/cds-kubernetes-rhel9:1790241897 | * |
| Red Hat Update Infrastructure 5 | RedHat | rhui5/cds-rhel9:1790241954 | * |
| Red Hat Update Infrastructure 5 | RedHat | rhui5/haproxy-rhel9:1790241900 | * |
| Red Hat Update Infrastructure 5 | RedHat | rhui5/installer-rhel9:1790241922 | * |
| Red Hat Update Infrastructure 5 | RedHat | rhui5/rhua-rhel9:1790242004 | * |
| Curl | Ubuntu | devel | * |
| Curl | Ubuntu | esm-infra/bionic | * |
| Curl | Ubuntu | esm-infra/focal | * |
| Curl | Ubuntu | jammy | * |
| Curl | Ubuntu | noble | * |
| Curl | Ubuntu | questing | * |
| Curl | Ubuntu | resolute | * |
| Curl | Ubuntu | upstream | * |
Extended Description
Data can “bleed” from one session to another through member variables of singleton objects, such as Servlets, and objects from a shared pool. In the case of Servlets, developers sometimes do not understand that, unless a Servlet implements the SingleThreadModel interface, the Servlet is a singleton; there is only one instance of the Servlet, and that single instance is used and re-used to handle multiple requests that are processed simultaneously by different threads. A common result is that developers use Servlet member fields in such a way that one user may inadvertently see another user’s data. In other words, storing user data in Servlet member fields introduces a data access race condition.