CVE-2025-0167: netrc and default credential leak

Disclosed: 2025-02-07 09:30:43 By sherlock2010 To curl
Low
Vulnerability Details
## Summary: The fix for CVE-2024-11053 seems to be incomplete.The information leak problem could be reproduced again if use netrc in step1. ## Affected version all ## Steps To Reproduce: 1. Adapt test479 to use netrc like below(both of user and password are not provided for b.com): machine a.com login alice password alicespassword default 2.Run test479 3. The test would fail because alice and alicepassword were used for b.com. I used the latest version curl 8.11.1 but the problem still exists.I'm not sure if this is expected.Please point it out if i'm wrong. ## Impact ## Summary: Sensitive information disclosure.
Actions
View on HackerOne
Report Stats
  • Report ID: 2917232
  • State: Closed
  • Substate: resolved
  • Upvotes: 1
Share this report