Description
When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that were only meant for the original origin. This is the same class of issue that libcurl fixed in 7.58.0 ( CVE-2018-1000007 https://github.com/advisories/GHSA-g7x2-hrfp-pv5f ).
Mitigation
Minimal update. May introduce new vulnerabilities or breaking changes.
|
 debian 13 | | =8.4.11-1 || =8.4.16-1 || =8.4.16-1~deb13u1 || =8.4.20-1 || =8.4.21-1 || =8.4.21-1~deb13u1 || =8.4.22-1 || =8.4.23-1 || =8.4.23-1~deb13u1 || =8.4.24-1 || =8.4.24-1~deb13u1 || >=0 <8.4.26-1~deb13u1 | 8.4.26-1~deb13u1 |
debian 14 | | =8.4.11-1 || =8.4.16-1 || =8.4.16-1~deb13u1 || =8.4.20-1 || =8.4.21-1 || =8.4.21-1~deb13u1 || =8.4.22-1 || =8.4.23-1 || =8.4.23-1~deb13u1 || =8.4.24-1 || =8.4.24-1~deb13u1 || =8.4.26-1~deb13u1 || >=0 <8.4.26-1 | 8.4.26-1 |
debian 12 | | =8.2.10-1 || =8.2.10-2 || =8.2.12-1 || =8.2.16-1 || =8.2.16-2 || =8.2.17-1 || =8.2.18-1 || =8.2.18-1~deb12u1 || =8.2.20-1~deb12u1 || =8.2.20-2 || =8.2.20-3 || =8.2.21-1 || =8.2.23-1 || =8.2.24-1 || =8.2.24-1~deb12u1 || =8.2.26-1~deb12u1 || =8.2.26-4 || =8.2.27-1 || =8.2.28-1~deb12u1 || =8.2.29-1~deb12u1 || =8.2.30-1~deb12u1 || =8.2.31-1~deb12u1 || =8.2.32-1~deb12u1 || =8.2.33-1~deb12u1 || =8.2.5-2 || =8.2.7-1 || =8.2.7-1.1 || =8.2.7-1.2 || =8.2.7-1~deb12u1 || >=0 <8.2.34-1~deb12u1 | 8.2.34-1~deb12u1 |
 rpm rhel10 | | - | - |
rpm rhel6 | | - | - |
rpm rhel8 | | <0:7.4.33-8.module+el8.10.0+25117+30337cca | 0:7.4.33-8.module+el8.10.0+25117+30337cca |
rpm rhel9 | | - | - |
rpm rhel10 | | - | - |
rpm rhel7 | | - | - |
