Skip to content
OpenAdvisories
Low USN-7162-1 1 CVE

curl vulnerability

Published Dec 16, 2024 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

Harry Sintonen discovered that curl incorrectly handled credentials from
.netrc files when following HTTP redirects. In certain configurations, the
password for the first host could be leaked to the followed-to host,
contrary to expectations.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS curl 7.68.0-1ubuntu2.25
Ubuntu · 22.04 LTS 22.04:LTS curl 7.81.0-1ubuntu1.20
Ubuntu · 24.04 LTS 24.04:LTS curl 8.5.0-2ubuntu10.6

Vulnerabilities 1

  • Low 3.4
    CVE-2024-11053

    netrc and redirect credential leak

    When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that …

    curl curl mysql curl Debian Ubuntu Azure Linux Alpine Wolfi

References

  • report
    https://ubuntu.com/security/CVE-2024-11053