#14844: curl-7.76.0
-------------------------+---------------------
Reporter: renodr | Owner: timtas
Type: enhancement | Status: closed
Priority: normal | Milestone: 10.2
Component: BOOK | Version: SVN
Severity: normal | Resolution: fixed
Keywords: |
-------------------------+---------------------
Comment (by renodr):
'''CVE-2021-22876'''
{{{
Automatic referer leaks credentials
===================================
Project curl Security Advisory, March 31st 2021 -
[Permalink](https://curl.se/docs/CVE-2021-22876.html)
VULNERABILITY
-------------
libcurl does not strip off user credentials from the URL when
automatically
populating the `Referer:` HTTP request header field in outgoing HTTP
requests,
and therefore risks leaking sensitive data to the server that is the
target of
the second HTTP request.
libcurl automatically sets the `Referer:` HTTP request header field in
outgoing HTTP requests if the `CURLOPT_AUTOREFERER` option is set. With
the
curl tool, it is enabled with `--referer ";auto"`.
We are not aware of any exploit of this flaw.
INFO
----
This flaw has existed in libcurl since commit
[f30ffef477](https://github.com/curl/curl/commit/f30ffef477) in libcurl
7.1.1,
released on August 21, 2000.
The Common Vulnerabilities and Exposures (CVE) project has assigned the
name
CVE-2021-22876 to this issue.
CWE-359: Exposure of Private Personal Information to an Unauthorized Actor
Severity: Low
AFFECTED VERSIONS
-----------------
- Affected versions: curl 7.1.1 to and including 7.75.0
- Not affected versions: curl < 7.1.1 and curl >= 7.76.0
Also note that libcurl is used by many applications, and not always
advertised as such.
THE SOLUTION
------------
If a provided URL contains credentials, they will be blanked out before
the
URL is used to populate the header field.
A [fix for
CVE-2021-22876](https://github.com/curl/curl/commit/7214288898f5625a6cc196e22a74232eada7861c)
(The patch URL will change in the final published version of this
advisory)
RECOMMENDATIONS
--------------
We suggest you take one of the following actions immediately, in order of
preference:
A - Upgrade libcurl to version 7.76.0
B - Apply the patch to your local version
C - Provide the credentials with `-u` or `CURLOPT_USERPWD`
D - Avoid `CURLOPT_AUTOREFERER` and `--referer ";auto"`,
TIMELINE
--------
This issue was reported to the curl project on February 12, 2021.
This advisory was posted on March 31st 2021.
CREDITS
-------
This issue was reported and patched by Viktor Szakats.
Thanks a lot!
}}}
--
Ticket URL: <http://wiki.linuxfromscratch.org/blfs/ticket/14844#comment:3>
BLFS Trac <http://wiki.linuxfromscratch.org/blfs>
Beyond Linux From Scratch
--
http://lists.linuxfromscratch.org/listinfo/blfs-book
FAQ: http://www.linuxfromscratch.org/blfs/faq.html
Unsubscribe: See the above information page
