When asked to use a `.netrc` file for credentials **and** to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a `default` entry that omits both login and password. A rare circumstance.
Cuando se le pide que use un archivo `.netrc` para las credenciales **y** para seguir redirecciones HTTP, curl podría filtrar la contraseña utilizada para el primer host al host siguiente en determinadas circunstancias. Esta falla solo se manifiesta si el archivo netrc tiene una entrada `default` que omite tanto el nombre de usuario como la contraseña. Una circunstancia poco común.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | HIGH |
| Privileges Required | NONE |
| User Interaction | REQUIRED |
| Scope | CHANGED |
| Confidentiality Impact | LOW |
| Integrity Impact | NONE |
| Availability Impact | NONE |
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Type: Secondary
Exploitability Score: 1.6
Impact Score: 1.4
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
NVD-CWE-noinfo
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| haxx | curl | * | <built-in method update of dict object at 0x7fd3697d7a80> | Application |
| netapp | element_software | - | <built-in method update of dict object at 0x7fd2db1b7a00> | Application |
| netapp | ontap | 9 | <built-in method update of dict object at 0x7fd3697d7dc0> | Application |
| netapp | ontap_select_deploy_administration_utility | - | <built-in method update of dict object at 0x7fd36aad2f40> | Application |
| netapp | ontap_tools | 9 | <built-in method update of dict object at 0x7fd3697d5180> | Application |
| netapp | solidfire_\&_hci_management_node | - | <built-in method update of dict object at 0x7fd3697d6140> | Application |
| netapp | solidfire_\&_hci_storage_node | - | <built-in method update of dict object at 0x7fd370398500> | Application |
| netapp | bootstrap_os | - | <built-in method update of dict object at 0x7fd384213800> | Operating System |
| netapp | h300s_firmware | - | <built-in method update of dict object at 0x7fd370398b40> | Operating System |
| netapp | h410c_firmware | - | <built-in method update of dict object at 0x7fd3697d5ec0> | Operating System |
| netapp | h410s_firmware | - | <built-in method update of dict object at 0x7fd37039abc0> | Operating System |
| netapp | h500s_firmware | - | <built-in method update of dict object at 0x7fd37039be40> | Operating System |
| netapp | h610c_firmware | - | <built-in method update of dict object at 0x7fd3697d7600> | Operating System |
| netapp | h610s_firmware | - | <built-in method update of dict object at 0x7fd38477e980> | Operating System |
| netapp | h615c_firmware | - | <built-in method update of dict object at 0x7fd3841f3600> | Operating System |
| netapp | h700s_firmware | - | <built-in method update of dict object at 0x7fd3854b3f80> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:netapp:element_software:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:ontap:9:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:ontap_tools:9:*:*:*:*:vmware_vsphere:*:* |
| Yes | cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:solidfire_\&_hci_storage_node:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h610c_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h610c:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h610s_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h610s:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h615c_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h615c:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* |