CVE-2024-11053

A flaw was found in curl. A logic error when processing credentials from the .netrc file while performing redirects allows the transfer of credentials from the original host to the followed-to host under certain circumstances, leaking the credentials to the followed-to host.

This issue only affects curl when a .netrc file is used and a redirect is performed. Additionally, the .netrc must match the target hostname but the followed-to host does not have a password or both login and password configured.

Example of a vulnerable .netrc configuration:

machine a.com
   login alice
   password alicespassword

default
   login bob

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Avoid using the .netrc file together with redirects.