curl: libcurl stale CURLOPT_AUTOREFERER leaks a previous request URL to a different origin on a reused easy handle

Summary: libcurl keeps a stale data-state.referer after an HTTP redirect when CURLOPTAUTOREFERER is enabled. Curlhttpfollow stores the previous URL into data-state.referer at lib/http.c:1166-1189, and later requests reuse that value when building Referer: at lib/http.c:2954-2957. In my local...

CLSA-2021-1617285762 Fix of CVE-2021-22876

back-port urlapi from v7.75.0 used by CVE-2021-22876 - strip credentials from the auto-referer header CVE-2021-22876...

Fix of CVE-2021-22876

back-port urlapi from v7.75.0 used by CVE-2021-22876 - strip credentials from the auto-referer header CVE-2021-22876...