Description
When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username (without a password), like `https://user@example.com/`, curl could wrongly get and use the password for *another* user set in the `.netrc` file for that host if such a one exists and there is no match for the specified user.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
curl curl
Default version status: unaffected
8.11.1 to < 8.14.2affected8.15.0 to < 8.16.1affected8.17.0 to < 8.20.1affected
curl curl
Default version status: unaffected
e9b9bbac22c26cf67316fa8e6c6b9e831af31949 to < 4ae1d7cc2643e4773a136395f12bc02fc6867854affected
curl curl
Default version status: unaffected
8.20.0affected8.19.0affected8.18.0affected8.17.0affected8.16.0affected8.15.0affected8.14.1affected8.14.0affected8.13.0affected8.12.1affected8.12.0affected8.11.1affected