CVE-2022-27774

Name of the Vulnerable Software and Affected Versions curl versions 4.9 through 7.82.0

Description The issue is related to the handling of HTTP(S) redirects during the authentication process in the cURL utility. When cURL follows redirects, it may leak credentials to other services on different protocols or port numbers. This could allow a remote attacker to gain unauthorized access to protected information. The problem arises because cURL's "same host check" is flawed, failing to consider cross-protocol redirects and different port numbers as separate hosts.

Recommendations For curl versions 4.9 through 7.82.0, consider disabling the ability to follow HTTP(S) redirects when using authentication to minimize the risk of credential leakage. Restrict access to sensitive information by limiting the use of cURL with authentication to only necessary cases. At the moment, there is no information about a newer version that contains a fix for this vulnerability.