CVE-2022-27776

Name of the Vulnerable Software and Affected Versions curl versions prior to 7.83.0

Description The issue is related to a insufficiently protected credentials vulnerability that may leak authentication or cookie header data on HTTP redirects to the same host but another port number. This could allow a remote attacker to incorrectly send the same set of headers to hosts that are identical to the first one but use a different port number or URL scheme. The vulnerability affects applications that pass on custom Authorization: or Cookie: headers, which often contain sensitive information.

Recommendations For versions prior to 7.83.0, update to curl 7.83.0 to fix the vulnerability. As a temporary workaround, consider using options that allow users to opt out from the flawed check, but note that this is not set by default. Restrict access to sensitive information and avoid using custom Authorization: or Cookie: headers in HTTP requests until the issue is resolved.