MGASA-2024-0391

Advisory lineage Upstream: 1 Downstream: 0
Upstream
CVE-2024-11053
Published: 17 Dec 2024, 19:42
Last modified:16 Apr 2026, 04:21

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

17 Dec 2024, 19:42
Published
Vulnerability first disclosed
16 Apr 2026, 04:21
Last Modified
Vulnerability information updated

Description

Updated curl packages fix security vulnerability When asked to both use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password. This update fixes this logic to avoid sending a password to the wrong host.

Affected Systems

  • mageia•curl

    < 7.88.1-4.5.mga9

References (3)