Lucene search

K
freebsdFreeBSD27F742F6-03F4-11E5-AAB1-D050996490D0
HistoryApr 29, 2015 - 12:00 a.m.

cURL -- sensitive HTTP server headers also sent to proxies

2015-04-2900:00:00
vuxml.freebsd.org
8

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.004 Low

EPSS

Percentile

72.6%

cURL reports:

libcurl provides applications a way to set custom HTTP
headers to be sent to the server by using CURLOPT_HTTPHEADER.
A similar option is available for the curl command-line
tool with the ‘–header’ option.
When the connection passes through an HTTP proxy the
same set of headers is sent to the proxy as well by default.
While this is by design, it has not necessarily been clear
nor understood by application programmers.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchcurl< 7.42.1UNKNOWN

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.004 Low

EPSS

Percentile

72.6%