Critical · published February 24, 2023
🔥 A surprising oversight in curl versions less than 7.88.0 can leave sensitive data exposed during serial URL transfers! Think of it like a security guard who only checks IDs at the entrance but ignores anyone trying to sneak in through the side door once the crowd starts moving. If curl doesn't carry over its HSTS (HTTP Strict Transport Security) settings, your data can take a detour into unprotected territory! An attacker could intercept cleartext data, compromising sensitive information and creating a serious security breach. This vulnerability could allow for data leaks during multiple requests, putting your privacy at risk and potentially leading to disastrous consequences.
Think of it like a security guard who only checks IDs at the entrance but ignores anyone trying to sneak in through the side door once the crowd starts moving. If curl doesn't carry over its HSTS (HTTP Strict Transport Security) settings, your data can take a detour into unprotected territory! The vulnerability in curl allows for cleartext transmission of sensitive information due to improper handling of HSTS settings when multiple URLs are requested in a single command. As a result, HTTPS settings may be ignored in subsequent requests, exposing data during transfers.
An attacker could intercept cleartext data, compromising sensitive information and creating a serious security breach. This vulnerability could allow for data leaks during multiple requests, putting your privacy at risk and potentially leading to disastrous consequences. Upgrade curl to version 7.88.0 or later immediately to ensure HSTS functionality operates correctly. Additionally, review your application for any instances where curl is used for multiple URL requests and ensure that secure connections are enforced. You've got this! Patch that curl version and bolt down your data security like a pro! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| haxx/curl | ≥ 7.77.0, < 7.88.0 | 7.88.0 |
| netapp/active_iq_unified_manager | all versions | — |
| netapp/clustered_data_ontap | all versions | — |
| netapp/h300s_firmware | all versions | — |
| netapp/h500s_firmware | all versions | — |
| netapp/h700s_firmware | all versions | — |
| netapp/h410s_firmware | all versions | — |
| splunk/universal_forwarder | ≥ 8.2.0, < 8.2.12 | 8.2.12 |
| splunk/universal_forwarder | ≥ 9.0.0, < 9.0.6 | 9.0.6 |
| splunk/universal_forwarder | all versions | — |