CVE-2018-1000007 - CVE House
Back to Database
Status published Critical CVE-2018-1000007

libcurl 7.1 through 7.57.0 might accidentally leak authentication data to...

Vulnerability Description

libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the `Location:` response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom `Authorization:` headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-1000007

Credits & Attribution

No credits recorded in the NVD database.

References

More from haxx

View All →
CVE-2022-42916
In curl before 7.86.0, the HSTS check could be bypassed...
Unknown 0
CVE-2022-42915
curl before 7.86.0 has a double free. If curl is...
Unknown 0
CVE-2020-19909
Integer overflow vulnerability in tool_operate.c in curl 7.65.2 via a...
Low 3.3
CVE-2018-1000300
curl version curl 7.54.1 to and including curl 7.59.0 contains...
Critical 9.8
CVE-2018-1000005
libcurl 7.49.0 to and including 7.57.0 contains an out bounds...
Critical 9.1

Affected Vendor

Affected Software

curl, debian linux, ubuntu linux, enterprise linux desktop, enterprise linux server, enterprise linux server aus, enterprise linux server eus, enterprise linux workstation, m10-1 firmware, m10-4 firmware, m10-4s firmware, m12-1 firmware, m12-2 firmware, m12-2s firmware
Vulnerable Versions:
7.1, 7.0, 8.0, 9.0, 12.04, 14.04, 16.04, 17.10, 7.4, 7.5, 0

Timeline

Official Publish: January 24th, 2018
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.