CVE-2024-11053

Name of the Vulnerable Software and Affected Versions: curl versions 6.5 through 8.11.0

Description: The issue arises when curl is used with a .netrc file for credentials and follows HTTP redirects. Under certain circumstances, curl could leak the password used for the first host to the followed-to host. This flaw only manifests itself if the .netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password.

Recommendations: For versions 6.5 through 8.11.0, upgrade to version 8.11.1 or later to mitigate the risk of credential leakage. As a temporary workaround, consider avoiding the use of .netrc files with curl or restricting access to sensitive information when following HTTP redirects.