Insufficiently Protected Credentials Vulnerability in curl
Summary
CVE-2022-27774: An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authenticat... Affects curl versions < 7.79.1-r1. Fixed in 7.79.1-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Curl is a command-line tool and library for transferring data with URLs. It supports various protocols, including HTTP, HTTPS, FTP, and more. The vulnerability affects versions 4.9 to 7.82.0 of curl. This vulnerability allows an attacker to extract credentials when following HTTP(S) redirects with authentication. As a result, credentials can be leaked to other services on different protocols or port numbers.
Vulnerability Detail
The insufficiently protected credentials vulnerability in curl arises due to a flaw in the handling of HTTP(S) redirects with authentication. When a redirect occurs, the credentials used for authentication are not adequately protected, allowing an attacker to intercept and extract them. This vulnerability can have severe consequences as it enables unauthorized access to sensitive information, potentially leading to unauthorized account access or data breaches.
How To Fix
Minimum fixed version
7.79.1-r1
This is the first release that contains the fix.
sudo apk add --upgrade curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can avoid using HTTP(S) redirects with authentication until the curl package is updated. This can be achieved by disabling or modifying the affected functionality in the application or script that utilizes curl. However, this workaround may not be feasible in all scenarios and should be considered temporary until the package is updated.
Conclusion
The insufficiently protected credentials vulnerability in curl can result in the leakage of authentication credentials, potentially leading to unauthorized access and data breaches. It is crucial to update the curl package to version 7.79.1-r1 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for curl →
FAQ
Curl is a command-line tool and library for transferring data with URLs. It supports various protocols, including HTTP, HTTPS, FTP, and more.
Versions 4.9 to 7.82.0 of curl are affected by this vulnerability.
This vulnerability can lead to the leakage of credentials used for authentication, potentially enabling unauthorized access to sensitive information and unauthorized account access.
To fix this vulnerability, it is recommended to upgrade curl to version 7.79.1-r1 or later.
A temporary workaround is to avoid using HTTP(S) redirects with authentication until the curl package is updated.
Related vulnerabilities
Recent vulnerabilities recorded for curl.
