An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to che…
Medium CVSS 5.9
Summary
An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI transfers and could potentially result in unauthorized access to sensitive information. The safest option is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been cha…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
- :
- :
- :
- :
- :
- :
- :
- :
- :
Sources
- NVD DATABASE
Original Links
- https://hackerone.com/reports/1895135 Exploit
- https://lists.debian.org/debian-lts-announce/2023/04/msg00025.html Mailing List
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36NBD5YLJXXEDZLDGNFCERWRYJQ6LAQW/ Mailing List
- https://security.gentoo.org/glsa/202310-12 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20230420-0010/ Third Party Advisory
- https://hackerone.com/reports/1895135 Exploit
- https://lists.debian.org/debian-lts-announce/2023/04/msg00025.html Mailing List
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36NBD5YLJXXEDZLDGNFCERWRYJQ6LAQW/ Mailing List
- https://security.gentoo.org/glsa/202310-12 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20230420-0010/ Third Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://cert-portal.siemens.com/productcert/html/ssa-806742.html
- https://cert-portal.siemens.com/productcert/html/ssa-943925.html
Timeline
- nvd_ingest NVD