Description
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
curl curl
Default version status: unaffected
7.64.1 to < 8.14.2affected8.15.0 to < 8.16.1affected8.17.0 to < 8.20.1affected8.21.0 to < 8.22.0affected
curl curl
Default version status: unaffected
6c6035532383e300c712e4c1cd9fdd749ed5cf59 to < 7103a93b05bc69ea98ed9d05d02fa9eeba533f2faffected
curl curl
Default version status: unaffected
8.21.0affected8.20.0affected8.19.0affected8.18.0affected8.17.0affected8.16.0affected8.15.0affected8.14.1affected8.14.0affected8.13.0affected8.12.1affected8.12.0affected8.11.1affected8.11.0affected8.10.1affected8.10.0affected8.9.1affected8.9.0affected8.8.0affected8.7.1affected8.7.0affected8.6.0affected8.5.0affected8.4.0affected8.3.0affected8.2.1affected8.2.0affected8.1.2affected8.1.1affected8.1.0affected8.0.1affected8.0.0affected7.88.1affected7.88.0affected7.87.0affected7.86.0affected7.85.0affected7.84.0affected7.83.1affected7.83.0affected7.82.0affected7.81.0affected7.80.0affected7.79.1affected7.79.0affected7.78.0affected7.77.0affected7.76.1affected7.76.0affected7.75.0affected7.74.0affected7.73.0affected7.72.0affected7.71.1affected7.71.0affected7.70.0affected7.69.1affected7.69.0affected7.68.0affected7.67.0affected7.66.0affected7.65.3affected7.65.2affected7.65.1affected7.65.0affected7.64.1affected