Anonymous connection In curl
Description
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally widen the permissions for the target file, leaving the updated file accessible to more users than intended.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 alpine v3.14 | 7.79.1-r2 | ||
 debian 13 | 7.84.0-1 | ||
alpine v3.16 | 7.83.1-r2 | ||
alpine v3.17 | 7.84.0-r0 | ||
alpine v3.18 | 7.84.0-r0 | ||
alpine v3.21 | 7.84.0-r0 | ||
alpine v3.22 | 7.84.0-r0 | ||
debian 12 | 7.84.0-1 | ||
debian 14 | 7.84.0-1 | ||
alpine v3.13 | 7.79.1-r2 |
1-10 of 16
10
Aliases
1. 2. 3. 4. 5. 6. 7.