Fluid Attacks Database

Description

cURL and libcurl 7.10.6 through 7.41.0 do not properly re-use authenticated Negotiate connections, which allows remote attackers to connect as other users via a request.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 12	curl	>=0 <7.42.0-1	7.42.0-1
debian 13	curl	>=0 <7.42.0-1	7.42.0-1
debian 14	curl	>=0 <7.42.0-1	7.42.0-1
rpm rhel5	curl	-	-
rpm rhel6	curl	<0:7.19.7-46.el6	0:7.19.7-46.el6
rpm rhel7	curl	<0:7.29.0-25.el7	0:7.29.0-25.el7

Aliases

1. CVE-2015-31482. NVD-2015-31483. OSV-DEBIAN-2015-31484. OSV-2015-31485. SECURITY-TRACKER-CVE-2015-3148

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.