| Titolo | CVE-2021-22876 , CVE-2021-22890 in cURL |
|---|
| Descrizione | Details:
Viktor Szakats discovered that curl did not strip off user credentials
from referrer header fields. A remote attacker could possibly use this
issue to obtain sensitive information. (CVE-2021-22876)
Mingtao Yang discovered that curl incorrectly handled session tickets when
using an HTTPS proxy. A remote attacker in control of an HTTPS proxy could
use this issue to bypass certificate checks and intercept communications.
This issue only affected Ubuntu 20.04 LTS and Ubuntu 20.10.
(CVE-2021-22890)
Source:
https://curl.se/docs/CVE-2021-22876.html
https://curl.se/docs/CVE-2021-22890.html
https://lists.debian.org/debian-security-announce/2021/msg00062.html
https://ubuntu.com/security/notices/USN-4898-1 |
|---|
| Fonte | ⚠️ https://curl.se/docs/CVE-2021-22876.html |
|---|
| Utente | CSieberg (UID 13359) |
|---|
| Sottomissione | 01/04/2021 09:29 (5 anni fa) |
|---|
| Moderazione | 01/04/2021 09:53 (24 minutes later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 172067 [cURL/libcURL fino a 7.75.0 Referer rivelazione di informazioni] |
|---|
| Punti | 20 |
|---|