lingering HTTP credentials in connection reuse

🗓️ 17 Jun 2015 08:00:00Reported by curlType

curl🔗 curl.se👁 1 Views

libcurl may reuse credentials after reset, risking authentication leakage on subsequent requests to the same host.

Reporter	Title	Published	Views	Family All 41
IBM Security Bulletins	Security Bulletin: Vulnerabilities in libcurl and cURL affect Rational DOORS (CVE-2015-3143, CVE-2015-3144, CVE-2015-3145, CVE-2015-3148, CVE-2015-3153, CVE-2015-3236)	1 May 202008:19	–	ibm
ALT Linux	Security fix for the ALT Linux 8 package curl version 7.43.0-alt1	19 Jun 201500:00	–	altlinux
Amazon	Medium: curl	18 Jun 201500:00	–	amazon
Tenable Nessus	Amazon Linux AMI : curl (ALAS-2015-551)	22 Jun 201500:00	–	nessus
Tenable Nessus	Fedora 22 : curl-7.40.0-5.fc22 (2015-10155)	25 Jun 201500:00	–	nessus
Tenable Nessus	FreeBSD : cURL -- Multiple Vulnerability (2438d4af-1538-11e5-a106-3c970e169bc2)	18 Jun 201500:00	–	nessus
Tenable Nessus	GLSA-201509-02 : cURL: Multiple vulnerabilities	25 Sep 201500:00	–	nessus
Tenable Nessus	NewStart CGSL MAIN 6.02 : curl Multiple Vulnerabilities (NS-SA-2024-0050)	10 Sep 202400:00	–	nessus
Tenable Nessus	openSUSE Security Update : curl (openSUSE-2015-446)	25 Jun 201500:00	–	nessus
Tenable Nessus	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : curl (SSA:2015-302-01)	30 Oct 201500:00	–	nessus