Description

curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '#' character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC to check for allowed domains before using curl to request them.

References

https://curl.haxx.se/docs/adv_20161102J.html

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8624

https://www.tenable.com/security/tns-2016-21

https://security.gentoo.org/glsa/201701-47

http://www.securitytracker.com/id/1037192

http://www.securityfocus.com/bid/94103

https://access.redhat.com/errata/RHSA-2018:2486

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

https://access.redhat.com/errata/RHSA-2018:3558

https://lists.apache.org/thread.html/[email protected]%3Ccommits.pulsar.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cissues.bookkeeper.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cissues.bookkeeper.apache.org%3E

Details

Risk Information

CVSS v2

CVSS v3