CVE-2021-22876

01/תיאור (מקור, אנגלית)

curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.

02/מוצרים מושפעים

haxx: libcurl; fedoraproject: fedora; netapp: hci management node; netapp: solidfire; netapp: hci compute node; netapp: hci storage node; broadcom: fabric operating system; debian: debian linux; siemens: sinec infrastructure network services; oracle: communications billing and revenue management; oracle: essbase; splunk: universal forwarder

03/קישורים10

• curl.se/docs/CVE-2021-22876.html PatchVendor Advisory
• curl.se/docs/CVE-2021-22876.html PatchVendor Advisory
• cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf PatchThird Party Advisory
• hackerone.com/reports/1101882 ExploitIssue TrackingPatchThird Party Advisory
• cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf PatchThird Party Advisory
• hackerone.com/reports/1101882 ExploitIssue TrackingPatchThird Party Advisory
• lists.debian.org/debian-lts-announce/2021/05/msg00019.html Mailing ListThird Party Advisory
• lists.fedoraproject.org/archives/list/package-announce%40lists‮… Mailing ListThird Party Advisory
• lists.fedoraproject.org/archives/list/package-announce%40lists‮… Mailing ListThird Party Advisory
• lists.fedoraproject.org/archives/list/package-announce%40lists‮… Mailing ListThird Party Advisory