Description
Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL isset next, leaking state information.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
curl curl
Default version status: unaffected
8.21.0 to ≤ 8.21.0affected8.20.0 to ≤ 8.20.0affected8.19.0 to ≤ 8.19.0affected8.18.0 to ≤ 8.18.0affected8.17.0 to ≤ 8.17.0affected8.16.0 to ≤ 8.16.0affected8.15.0 to ≤ 8.15.0affected8.14.1 to ≤ 8.14.1affected8.14.0 to ≤ 8.14.0affected8.13.0 to ≤ 8.13.0affected8.12.1 to ≤ 8.12.1affected8.12.0 to ≤ 8.12.0affected8.11.1 to ≤ 8.11.1affected8.11.0 to ≤ 8.11.0affected8.10.1 to ≤ 8.10.1affected8.10.0 to ≤ 8.10.0affected8.9.1 to ≤ 8.9.1affected8.9.0 to ≤ 8.9.0affected8.8.0 to ≤ 8.8.0affected8.7.1 to ≤ 8.7.1affected8.7.0 to ≤ 8.7.0affected8.6.0 to ≤ 8.6.0affected8.5.0 to ≤ 8.5.0affected8.4.0 to ≤ 8.4.0affected8.3.0 to ≤ 8.3.0affected8.2.1 to ≤ 8.2.1affected8.2.0 to ≤ 8.2.0affected8.1.2 to ≤ 8.1.2affected8.1.1 to ≤ 8.1.1affected8.1.0 to ≤ 8.1.0affected8.0.1 to ≤ 8.0.1affected8.0.0 to ≤ 8.0.0affected7.88.1 to ≤ 7.88.1affected7.88.0 to ≤ 7.88.0affected7.87.0 to ≤ 7.87.0affected7.86.0 to ≤ 7.86.0affected7.85.0 to ≤ 7.85.0affected7.84.0 to ≤ 7.84.0affected7.83.1 to ≤ 7.83.1affected7.83.0 to ≤ 7.83.0affected7.82.0 to ≤ 7.82.0affected7.81.0 to ≤ 7.81.0affected7.80.0 to ≤ 7.80.0affected7.79.1 to ≤ 7.79.1affected7.79.0 to ≤ 7.79.0affected7.78.0 to ≤ 7.78.0affected7.77.0 to ≤ 7.77.0affected7.76.1 to ≤ 7.76.1affected7.76.0 to ≤ 7.76.0affected7.75.0 to ≤ 7.75.0affected