proxy credentials leak over redirect-to proxy
Platform
curl
Component
curl
Fixed in
8.19.1
curl might erroneously pass on credentials for a first proxy to a second proxy.
This can happen when the following conditions are true:
1. curl is setup to use specific different proxies for different URL schemes
2. the first proxy needs credentials
3. the second proxy uses no credentials
4. while using the first proxy (using say http://), curl is asked to follow
a redirect to a URL using another scheme (say https://), accessed using a
second, different, proxy
Threat Intelligence
Exploit Status
EPSS
0.02% (4% percentile)
Affected Software
Weakness Classification (CWE)
Timeline
- Reserved
- Published
- EPSS updated
How to fix
Actualice a la versión 8.19.1 o superior para evitar la divulgación accidental de credenciales de proxy. Este problema ocurre al seguir redirecciones entre diferentes esquemas de URL cuando se utilizan proxies con y sin credenciales. Asegúrese de que su versión de cURL esté actualizada para mitigar este riesgo.
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Try it now — no account
Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
Drag & drop your dependency file
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...