Low · published February 5, 2025
When asked to use a `.netrc` file for credentials **and** to follow HTTP
redirects, curl could leak the password used for the first host to the
followed-to host under certain circumstances.
This flaw only manifests itself if the netrc file has a `default` entry that
omits both login and password. A rare circumstance.
| Product | Versions | Fixed in |
|---|---|---|
| haxx/curl | ≥ 7.76.0, < 8.12.0 | 8.12.0 |
| netapp/h700s_firmware | all versions | — |
| netapp/h615c_firmware | all versions | — |
| netapp/h610s_firmware | all versions | — |
| netapp/h610c_firmware | all versions | — |
| netapp/h500s_firmware | all versions | — |
| netapp/h410s_firmware | all versions | — |
| netapp/h410c_firmware | all versions | — |
| netapp/h300s_firmware | all versions | — |
| netapp/bootstrap_os | all versions | — |
| netapp/element_software | all versions | — |
| netapp/ontap | all versions | — |
| netapp/ontap_select_deploy_administration_utility | all versions | — |
| netapp/ontap_tools | all versions | — |
| netapp/solidfire_\&_hci_management_node | all versions | — |
| netapp/solidfire_\&_hci_storage_node | all versions | — |