CVE-2024-11053
LowSummary
When curl is asked to use a `.netrc` file for credentials and to follow HTTP redirects, it could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests if the netrc file has an entry matching the redirect target hostname.
Risk Assessment
The risk is potential disclosure of credentials (passwords) to unauthorized parties, which could lead to account compromise.
Recommendation
Update curl to a patched version and avoid using netrc files with redirects if possible.
Original NVD description (English source)
When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but