Loading vulnerability…
curl netrc password leak
CVE-2024-11053 is a credential-disclosure vulnerability in curl's handling of netrc credentials across HTTP redirects. When curl uses a netrc credential file and follows a redirect to another hostname, it can disclose the password used for the initial host to the destination host. The flaw occurs when a credential-file entry matches the redirect destination hostname but omits either the password alone or both the login and password.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
The redirect destination can receive a password intended for the original host, compromising credential confidentiality. If the exposed password remains valid and the attacker can satisfy any additional authentication requirements, it could enable unauthorized access to the original service or other services accepting the same credential. Direct code execution, data modification, and denial of service are not established impacts of this vulnerability.
If you can’t patch tonight, do this now.
Until patched, avoid combining netrc-based authentication with automatic HTTP redirect following. Disable automatic redirects where practical, or disable netrc credential use for those transfers. Review credential-file entries for potential redirect destinations and avoid entries that omit the password or both login and password. Restrict redirect destinations to trusted hosts where application functionality permits.
Patch, then assume compromise.
Install vendor-provided curl/libcurl updates or update products bundling the vulnerable component. For Siemens COMOS V10.4.5 releases earlier than V10.4.5.0.2, obtain the patch and update guidance from Siemens support; upgrade affected COMOS V10.6 deployments to V10.6.1 or later. For the identified Google Container-Optimized OS packages, apply the update identified as version 18244.291.20 or later. Standalone upstream curl affected and fixed version ranges are not available in the supplied vulnerability details.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
25 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.