When processing an HTTP redirect to a URL containing userinfo (a
username:password component), curl might erroneously retain and re-transmit
the original hosts HTTP Negotiate authentication state. Consequently, a
malicious server can trigger a redirect containing arbitrary userinfo to force
curl to send a freshly minted Kerberos ticket—generated using the ambient
identity of the client process to an untrusted third-party host, effectively
bypassing the domain-scoping restrictions normally enforced by the absence of
--location-trusted.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Red Hat Hardened Images | RedHat | curl-main-8.23.0-0.1.hum1 | * |
| Curl | Ubuntu | upstream | * |