IM
IronMonkey Threat Research

CVE-2024-11053 LOW

Published: 2024-12-11 | Last Modified: 2025-11-03 | Status: Modified

Description

When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password.

Additional Descriptions (1)

Cuando se le pide que use un archivo `.netrc` para las credenciales y que siga las redirecciones HTTP, curl podría filtrar la contraseña utilizada para el primer host al host al que sigue en determinadas circunstancias. Esta falla solo se manifiesta si el archivo netrc tiene una entrada que coincide con el nombre de host de destino de la redirección, pero la entrada omite solo la contraseña u omite tanto el nombre de usuario como la contraseña.

CVSS Metrics

Base Score: 3.4 (LOW)

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N

Attack VectorNETWORK
Attack ComplexityHIGH
Privileges RequiredNONE
User InteractionREQUIRED
ScopeCHANGED
Confidentiality ImpactLOW
Integrity ImpactNONE
Availability ImpactNONE

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Type: Secondary

Exploitability Score: 1.6

Impact Score: 1.4

Weaknesses

Source Type Description
[email protected] Primary
en NVD-CWE-noinfo

Affected Products

Vendor Product Version Update Type
haxx curl * <built-in method update of dict object at 0x7fd36a139140> Application
netapp ontap 9 <built-in method update of dict object at 0x7fd3199c11c0> Application
netapp ontap_select_deploy_administration_utility - <built-in method update of dict object at 0x7fd340f0ef80> Application
netapp h610c_firmware - <built-in method update of dict object at 0x7fd340a41480> Operating System
netapp h610s_firmware - <built-in method update of dict object at 0x7fd384658a40> Operating System
netapp h615c_firmware - <built-in method update of dict object at 0x7fd38465b340> Operating System
netapp h700s_firmware - <built-in method update of dict object at 0x7fd2dbe0c0c0> Operating System
netapp bootstrap_os - <built-in method update of dict object at 0x7fd360692a40> Operating System
netapp h300s_firmware - <built-in method update of dict object at 0x7fd3686c76c0> Operating System
netapp h410s_firmware - <built-in method update of dict object at 0x7fd38465a8c0> Operating System
netapp h500s_firmware - <built-in method update of dict object at 0x7fd340a12fc0> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:netapp:ontap:9:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h610c_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h610c:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h610s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h610s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h615c_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h615c:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*

References