CVE-2021-22876

curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.

curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.

curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets. When using a HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived from the remote server and then wrongly "short-cut" the host handshake. When confusing the tickets, a HTTPS proxy can trick libcurl to use the wrong session ticket resume for the host and thereby circumvent the server TLS certificate check and make a MITM attack to be possible to perform unnoticed. Note that such a malicious HTTPS proxy needs to provide a certificate that curl will accept for the MITMed server for an attack to work - unless curl has been told to ignore the server certificate check.(CVE-2021-22890)

curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.(CVE-2021-22876)

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

• curl: Leak of authentication credentials in URL via automatic Referer (CVE-2021-22876)

• curl: TELNET stack contents disclosure (CVE-2021-22898)

• curl: Incorrect fix for CVE-2021-22898 TELNET stack contents disclosure (CVE-2021-22925)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.

curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

• curl: Leak of authentication credentials in URL via automatic Referer (CVE-2021-22876)

• curl: TELNET stack contents disclosure (CVE-2021-22898)

• curl: Incorrect fix for CVE-2021-22898 TELNET stack contents disclosure (CVE-2021-22925)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• back-port urlapi from v7.75.0 (used by CVE-2021-22876)
• strip credentials from the auto-referer header (CVE-2021-22876)

• back-port urlapi from v7.75.0 (used by CVE-2021-22876)
• strip credentials from the auto-referer header (CVE-2021-22876)

• CVE-2021-22925: fix TELNET stack contents disclosure again
• CVE-2021-22898: fix TELNET stack contents disclosure
• CVE-2021-22876: prevent automatic referer from leaking credentials

• SECURITY UPDATE: acceptance of hosts not listed in specified known_hosts file during SSH-based transfers
  • debian/patches/CVE-2025-15079.patch: Set both knownhosts options to same file and fix surprises caused by libssh exposing separate KNOWNHOSTS and GLOBAL_KNOWNHOSTS options.
  • CVE-2025-15079
• Regenerate Server-localhost-lastSAN-sv test certificate with SHA-256
  • debian/patches/regenerate-lastSAN-cert-sha256.patch: Fix "ca md too weak" error with OpenSSL 1.1.1+ by replacing SHA-1 signed certificate with SHA-256. Also fixes Makefile.am bug for lastSAN target.
• Update failed test
  • debian/patches/26_CVE-2021-22876.patch: Update test to avoid using unsupported commands
• Update failed test
  • debian/patches/fix-test323-errorcode.patch: two valid error codes now
• Disable some tests
  • debian/rules: add option to disable tests marked as flaky, fail the build if any test fails
  • debian/patches/add-flaky-to-test1592.patch: mark test1592 as flaky
  • debian/patches/disable-nss-failing-tests.patch: libnsspem.so is not available on Debian 10
• Remove unsupported test:
  • debian/patches/test8-verify-that-ctrl-byte-cookies-are-ignored.patch: no ctrl-byte-cookies are supported

libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.

libcurl automatically sets the Referer: HTTP request header field in outgoing HTTP requests if the CURLOPT_AUTOREFERER option is set. With the curl tool, it is enabled with --referer ";auto".

libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request. (CVE-2021-22876)

TLS 1.3 session ticket proxy host mixup. (CVE-2021-22890)

This update for curl fixes the following issues:

• CVE-2021-22890: TLS 1.3 session ticket proxy host mixup (bsc#1183934)
• CVE-2021-22876: Automatic referer leaks credentials (bsc#1183933)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

These are all security issues fixed in the curl-7.79.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for curl fixes the following issues:

• CVE-2021-22890: TLS 1.3 session ticket proxy host mixup (bsc#1183934)
• CVE-2021-22876: Automatic referer leaks credentials (bsc#1183933)

This update for curl fixes the following issues:

• CVE-2021-22876: Fixed an issue where the automatic referer was leaking credentials (bsc#1183933).

This update for curl fixes the following issues:

• CVE-2021-22876: Fixed an issue where the automatic referer was leaking credentials (bsc#1183933).

This update for curl fixes the following issues:

• CVE-2021-22898: TELNET stack contents disclosure (bsc#1186114)
• CVE-2021-22876: The automatic referer leaks credentials (bsc#1183933)
• CVE-2020-8286: Inferior OCSP verification (bsc#1179593)
• CVE-2020-8285: FTP wildcard stack overflow (bsc#1179399)
• CVE-2020-8284: Trusting FTP PASV responses (bsc#1179398)
• CVE-2020-8231: libcurl will pick and use the wrong connection with multiple requests with libcurl's multi API and the 'CURLOPT_CONNECT_ONLY' option (bsc#1175109)
• Fix: SFTP uploads result in empty uploaded files (bsc#1177976)

This update for curl fixes the following issues:

• CVE-2021-22876: Fixed an issue where the automatic referer was leaking credentials (bsc#1183933).
• CVE-2021-22898: Fixed curl TELNET stack contents disclosure (bsc#1186114).
• Fix for SFTP uploads when it results in empty uploaded files (bsc#1177976).
• Allow partial chain verification (jsc#SLE-17956).

Viktor Szakats discovered that curl did not strip off user credentials from referrer header fields. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2021-22876)

Mingtao Yang discovered that curl incorrectly handled session tickets when using an HTTPS proxy. A remote attacker in control of an HTTPS proxy could use this issue to bypass certificate checks and intercept communications. This issue only affected Ubuntu 20.04 LTS and Ubuntu 20.10. (CVE-2021-22890)

Viktor Szakats discovered that curl did not strip off user credentials from referrer header fields. A remote attacker could possibly use this issue to obtain sensitive information.