Fluid Attacks Database

Description

When asked to use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances.

This flaw only manifests itself if the netrc file has a default entry that omits both login and password. A rare circumstance.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 13	curl	>=0 <8.12.0+git20250209.89ed161+ds-1	8.12.0+git20250209.89ed161+ds-1
debian 14	curl	>=0 <8.12.0+git20250209.89ed161+ds-1	8.12.0+git20250209.89ed161+ds-1
alpine v3.18	curl	>=7.76.0 <8.12.0-r0	8.12.0-r0
alpine v3.19	curl	>=7.76.0 <8.12.0-r0	8.12.0-r0
alpine v3.20	curl	>=7.76.0 <8.12.0-r0	8.12.0-r0
alpine v3.21	curl	>=7.76.0 <8.12.0-r0	8.12.0-r0
alpine v3.22	curl	>=7.76.0 <8.12.0-r0	8.12.0-r0
debian 12	curl	=7.88.1-10 \|\| =7.88.1-10+deb12u1 \|\| =7.88.1-10+deb12u1~bpo11+1 \|\| =7.88.1-10+deb12u2 \|\| =7.88.1-10+deb12u3 \|\| =7.88.1-10+deb12u3~bpo11+1 \|\| =7.88.1-10+deb12u4 \|\| =7.88.1-10+deb12u5 \|\| =7.88.1-10+deb12u5~bpo11+1 \|\| =7.88.1-10+deb12u6 \|\| =7.88.1-10+deb12u6~bpo11+1 \|\| =7.88.1-10+deb12u7 \|\| =7.88.1-10+deb12u8 \|\| =7.88.1-10+deb12u9 \|\| >=0 <7.88.1-10+deb12u11	7.88.1-10+deb12u11
alpine v3.23	curl	>=7.76.0 <8.12.0-r0	8.12.0-r0
alpine v3.24	curl	>=7.76.0 <8.12.0-r0	8.12.0-r0

Aliases

1. CVE-2025-01672. NVD-2025-01673. OSV-DEBIAN-2025-01674. OSV-2025-01675. OSV-ALPINE-2025-01676. SECURITY-TRACKER-CVE-2025-01677. SECURITY-CVE-2025-0167

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.