Insertion of Sensitive Information Into Sent Data Affecting curl package, versions [7.10.8,8.23.0)

curl is a command line tool and library for transferring data with URL syntax, supporting DICT, FILE, FTP, FTPS, GOPHER, GOPHERS, HTTP, HTTPS, IMAP, IMAPS, LDAP, LDAPS, MQTT, POP3, POP3S, RTMP, RTMPS, RTSP, SCP, SFTP, SMB, SMBS, SMTP, SMTPS, TELNET and TFTP. libcurl offers a myriad of powerful features.

Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data in the tunnel process. An attacker can obtain sensitive authentication credentials by intercepting traffic through a malicious or compromised HTTP proxy server that responds with an HTTP 401 Unauthorized status code instead of a proxy authentication challenge. This is only exploitable if outbound traffic is routed through an untrusted or compromised HTTP proxy and the client transmits authentication data over a proxied tunnel.

• GitHub Commit
• Red Hat Bugzilla Bug