CVE-2018-1000007
libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When...
libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom Authorization: headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom Authorization: headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request.
- Record
CVE-2018-1000007- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE List No score
libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom Authorization: headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request.
- Record
CVE-2018-1000007- Updated
- 2026-11-02
EUVDEUVD-2018-1778 No score
libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom Authorization: headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request.
- Record
EUVD-2018-1778- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g7x2-hrfp-pv5f
libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When...
libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom Authorization: headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request.
- Record
GHSA-g7x2-hrfp-pv5f- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom Authorization: headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request.
- Record
CVE-2018-1000007- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-1000007
libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom Authorization: headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request.
- Record
DEBIAN-CVE-2018-1000007- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 12 moreShow less
OSVRHSA-2018:3157
Red Hat Security Advisory: curl and nss-pem security and bug fix update
- Record
RHSA-2018:3157- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L - Updated
- 2026-11-02
OSVRHSA-2018:3558
Red Hat Security Advisory: httpd24 security, bug fix, and enhancement update
- Record
RHSA-2018:3558- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2020:0544
Red Hat Security Advisory: curl security update
- Record
RHSA-2020:0544- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L - Updated
- 2026-11-02
OSVRHSA-2020:0594
Red Hat Security Advisory: curl security update
- Record
RHSA-2020:0594- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-1000007
libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom Authorization: headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request.
- Record
UBUNTU-CVE-2018-1000007- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1778778961 No score
curl: Fix of 2 CVEs
- CVE-2018-1000120: fix buffer overflow exists in the FTP URL handling
- CVE-2018-1000007: fix leak authentication data to third parties in HTTP requests
- Record
CLSA-2026-1778778961- Updated
- 2026-11-02
OSVCLSA-2026-1778786567 No score
curl: Fix of 2 CVEs
- CVE-2018-1000120: fix buffer overflow exists in the FTP URL handling
- CVE-2018-1000007: fix leak authentication data to third parties in HTTP requests
- Record
CLSA-2026-1778786567- Updated
- 2026-11-02
OSVCURL-CVE-2018-1000007 No score
HTTP authentication leak in redirects
curl might leak authentication data to third parties.
When asked to send custom headers in its HTTP requests, curl sends that set of
headers first to the host in the initial URL but also, if asked to follow
redirects and a 30X HTTP response code is returned, to the host mentioned in
URL in the Location: response header value.
Sending the same set of headers to subsequent hosts is in particular a problem
for applications that pass on custom Authorization: headers, as this header
often contains privacy sensitive information or data that could allow others
to impersonate the curl-using client's request.
- Record
CURL-CVE-2018-1000007- Updated
- 2026-11-02
OSVSUSE-SU-2018:0214-1 No score
Security update for curl
This update for curl fixes several issues.
These security issues were fixed:
- CVE-2017-1000254: Fix FTP PWD response parser out of bounds read (bsc#1061876).
- CVE-2018-1000007: Prevent leaking authentication data to third parties when following redirects (bsc#1077001)
Also the following adjustment was made:
- Set DEFAULT_SUSE as the default cipher list (bsc#1027712)
- Record
SUSE-SU-2018:0214-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:0217-1 No score
Security update for curl
This update for curl fixes one issues.
This security issue was fixed:
- CVE-2018-1000007: Prevent leaking authentication data to third parties when following redirects (bsc#1077001)
- Record
SUSE-SU-2018:0217-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:0230-1 No score
Security update for curl
This update for curl several issues.
This security issue was fixed:
- CVE-2018-1000007: Prevent leaking authentication data to third parties when following redirects (bsc#1077001)
This non-security issue was fixed:
- Set DEFAULT_SUSE as the default cipher list (bsc#1027712]
- Record
SUSE-SU-2018:0230-1- Updated
- 2026-11-02
OSVUSN-3554-1 No score
curl vulnerabilities
It was discovered that curl incorrectly handled certain data. An attacker could possibly use this to cause a denial of service or even to get access to sensitive data. This issue only affected Ubuntu 16.04 LTS and Ubuntu 17.10.
It was discovered that curl could accidentally leak authentication data. An attacker could possibly use this to get access to sensitive information. (CVE-2018-1000007)
- Record
USN-3554-1- Updated
- 2026-11-02
Affected products
- haxx curl
- canonical ubuntu linux
- debian linux
- fujitsu m10-1 firmware
- fujitsu m10-4 firmware
- fujitsu m10-4s firmware
- fujitsu m12-1 firmware
- fujitsu m12-2 firmware
- fujitsu m12-2s firmware
- redhat enterprise linux desktop
- redhat enterprise linux server
- redhat enterprise linux server aus
Show 2 moreShow less
Affected packages
| Package | Affected | Fixed |
|---|---|---|
curlTuxCare:OracleLinux:6 From an advisory covering 2 CVEs |
before 7.19.7-59.el6.tuxcare.els16 | 7.19.7-59.el6.tuxcare.els16 |
libcurlTuxCare:OracleLinux:6 From an advisory covering 2 CVEs |
before 7.19.7-59.el6.tuxcare.els16 | 7.19.7-59.el6.tuxcare.els16 |
libcurl-develTuxCare:OracleLinux:6 From an advisory covering 2 CVEs |
before 7.19.7-59.el6.tuxcare.els16 | 7.19.7-59.el6.tuxcare.els16 |
curlTuxCare:CentOS:6 From an advisory covering 2 CVEs |
before 7.19.7-59.el6.tuxcare.els16 | 7.19.7-59.el6.tuxcare.els16 |
libcurlTuxCare:CentOS:6 From an advisory covering 2 CVEs |
before 7.19.7-59.el6.tuxcare.els16 | 7.19.7-59.el6.tuxcare.els16 |
libcurl-develTuxCare:CentOS:6 From an advisory covering 2 CVEs |
before 7.19.7-59.el6.tuxcare.els16 | 7.19.7-59.el6.tuxcare.els16 |
curlDebian:12 |
before 7.58.0-1 | 7.58.0-1 |
curlDebian:13 |
before 7.58.0-1 | 7.58.0-1 |
curlDebian:14 |
before 7.58.0-1 | 7.58.0-1 |
curlDebian:7 |
before 7.26.0-1+wheezy24, plus listed versions 7.26.0-1+wheezy107.26.0-1+wheezy117.26.0-1+wheezy127.26.0-1+wheezy137.26.0-1+wheezy14 Show 17 moreShow less7.26.0-1+wheezy157.26.0-1+wheezy167.26.0-1+wheezy177.26.0-1+wheezy187.26.0-1+wheezy197.26.0-1+wheezy27.26.0-1+wheezy207.26.0-1+wheezy217.26.0-1+wheezy227.26.0-1+wheezy237.26.0-1+wheezy37.26.0-1+wheezy47.26.0-1+wheezy57.26.0-1+wheezy67.26.0-1+wheezy77.26.0-1+wheezy87.26.0-1+wheezy9 |
7.26.0-1+wheezy24 |
Show 99 moreShow less
| Package | Affected | Fixed |
|---|---|---|
curlDebian:8 |
before 7.38.0-4+deb8u9, plus listed versions 7.38.0-47.38.0-4+deb8u17.38.0-4+deb8u27.38.0-4+deb8u37.38.0-4+deb8u4 Show 4 moreShow less7.38.0-4+deb8u57.38.0-4+deb8u67.38.0-4+deb8u77.38.0-4+deb8u8 |
7.38.0-4+deb8u9 |
curlDebian:9 |
before 7.52.1-5+deb9u4, plus listed versions 7.52.1-57.52.1-5+deb9u17.52.1-5+deb9u27.52.1-5+deb9u3 |
7.52.1-5+deb9u4 |
curlRed Hat:enterprise_linux:7::client From an advisory covering 5 CVEs |
before 0:7.29.0-51.el7 | 0:7.29.0-51.el7 |
curl-debuginfoRed Hat:enterprise_linux:7::client From an advisory covering 5 CVEs |
before 0:7.29.0-51.el7 | 0:7.29.0-51.el7 |
libcurlRed Hat:enterprise_linux:7::client From an advisory covering 5 CVEs |
before 0:7.29.0-51.el7 | 0:7.29.0-51.el7 |
nss-pemRed Hat:enterprise_linux:7::client From an advisory covering 5 CVEs |
before 0:1.0.3-5.el7 | 0:1.0.3-5.el7 |
nss-pem-debuginfoRed Hat:enterprise_linux:7::client From an advisory covering 5 CVEs |
before 0:1.0.3-5.el7 | 0:1.0.3-5.el7 |
libcurl-develRed Hat:enterprise_linux:7::client From an advisory covering 5 CVEs |
before 0:7.29.0-51.el7 | 0:7.29.0-51.el7 |
curlRed Hat:enterprise_linux:7::computenode From an advisory covering 5 CVEs |
before 0:7.29.0-51.el7 | 0:7.29.0-51.el7 |
curl-debuginfoRed Hat:enterprise_linux:7::computenode From an advisory covering 5 CVEs |
before 0:7.29.0-51.el7 | 0:7.29.0-51.el7 |
libcurlRed Hat:enterprise_linux:7::computenode From an advisory covering 5 CVEs |
before 0:7.29.0-51.el7 | 0:7.29.0-51.el7 |
nss-pemRed Hat:enterprise_linux:7::computenode From an advisory covering 5 CVEs |
before 0:1.0.3-5.el7 | 0:1.0.3-5.el7 |
nss-pem-debuginfoRed Hat:enterprise_linux:7::computenode From an advisory covering 5 CVEs |
before 0:1.0.3-5.el7 | 0:1.0.3-5.el7 |
libcurl-develRed Hat:enterprise_linux:7::computenode From an advisory covering 5 CVEs |
before 0:7.29.0-51.el7 | 0:7.29.0-51.el7 |
curlRed Hat:enterprise_linux:7::server From an advisory covering 5 CVEs |
before 0:7.29.0-51.el7 | 0:7.29.0-51.el7 |
curl-debuginfoRed Hat:enterprise_linux:7::server From an advisory covering 5 CVEs |
before 0:7.29.0-51.el7 | 0:7.29.0-51.el7 |
libcurlRed Hat:enterprise_linux:7::server From an advisory covering 5 CVEs |
before 0:7.29.0-51.el7 | 0:7.29.0-51.el7 |
libcurl-develRed Hat:enterprise_linux:7::server From an advisory covering 5 CVEs |
before 0:7.29.0-51.el7 | 0:7.29.0-51.el7 |
nss-pemRed Hat:enterprise_linux:7::server From an advisory covering 5 CVEs |
before 0:1.0.3-5.el7 | 0:1.0.3-5.el7 |
nss-pem-debuginfoRed Hat:enterprise_linux:7::server From an advisory covering 5 CVEs |
before 0:1.0.3-5.el7 | 0:1.0.3-5.el7 |
curlRed Hat:enterprise_linux:7::workstation From an advisory covering 5 CVEs |
before 0:7.29.0-51.el7 | 0:7.29.0-51.el7 |
curl-debuginfoRed Hat:enterprise_linux:7::workstation From an advisory covering 5 CVEs |
before 0:7.29.0-51.el7 | 0:7.29.0-51.el7 |
libcurlRed Hat:enterprise_linux:7::workstation From an advisory covering 5 CVEs |
before 0:7.29.0-51.el7 | 0:7.29.0-51.el7 |
libcurl-develRed Hat:enterprise_linux:7::workstation From an advisory covering 5 CVEs |
before 0:7.29.0-51.el7 | 0:7.29.0-51.el7 |
nss-pemRed Hat:enterprise_linux:7::workstation From an advisory covering 5 CVEs |
before 0:1.0.3-5.el7 | 0:1.0.3-5.el7 |
nss-pem-debuginfoRed Hat:enterprise_linux:7::workstation From an advisory covering 5 CVEs |
before 0:1.0.3-5.el7 | 0:1.0.3-5.el7 |
httpd24-curlRed Hat:rhel_software_collections:3::el6 From an advisory covering 38 CVEs |
before 0:7.61.1-1.el6 | 0:7.61.1-1.el6 |
httpd24-curl-debuginfoRed Hat:rhel_software_collections:3::el6 From an advisory covering 38 CVEs |
before 0:7.61.1-1.el6 | 0:7.61.1-1.el6 |
httpd24-httpdRed Hat:rhel_software_collections:3::el6 From an advisory covering 38 CVEs |
before 0:2.4.34-7.el6 | 0:2.4.34-7.el6 |
httpd24-httpd-debuginfoRed Hat:rhel_software_collections:3::el6 From an advisory covering 38 CVEs |
before 0:2.4.34-7.el6 | 0:2.4.34-7.el6 |
httpd24-httpd-develRed Hat:rhel_software_collections:3::el6 From an advisory covering 38 CVEs |
before 0:2.4.34-7.el6 | 0:2.4.34-7.el6 |
httpd24-httpd-manualRed Hat:rhel_software_collections:3::el6 From an advisory covering 38 CVEs |
before 0:2.4.34-7.el6 | 0:2.4.34-7.el6 |
httpd24-httpd-toolsRed Hat:rhel_software_collections:3::el6 From an advisory covering 38 CVEs |
before 0:2.4.34-7.el6 | 0:2.4.34-7.el6 |
httpd24-libcurlRed Hat:rhel_software_collections:3::el6 From an advisory covering 38 CVEs |
before 0:7.61.1-1.el6 | 0:7.61.1-1.el6 |
httpd24-libcurl-develRed Hat:rhel_software_collections:3::el6 From an advisory covering 38 CVEs |
before 0:7.61.1-1.el6 | 0:7.61.1-1.el6 |
httpd24-libnghttp2Red Hat:rhel_software_collections:3::el6 From an advisory covering 38 CVEs |
before 0:1.7.1-7.el6 | 0:1.7.1-7.el6 |
httpd24-libnghttp2-develRed Hat:rhel_software_collections:3::el6 From an advisory covering 38 CVEs |
before 0:1.7.1-7.el6 | 0:1.7.1-7.el6 |
httpd24-mod_ldapRed Hat:rhel_software_collections:3::el6 From an advisory covering 38 CVEs |
before 0:2.4.34-7.el6 | 0:2.4.34-7.el6 |
httpd24-mod_proxy_htmlRed Hat:rhel_software_collections:3::el6 From an advisory covering 38 CVEs |
before 1:2.4.34-7.el6 | 1:2.4.34-7.el6 |
httpd24-mod_sessionRed Hat:rhel_software_collections:3::el6 From an advisory covering 38 CVEs |
before 0:2.4.34-7.el6 | 0:2.4.34-7.el6 |
httpd24-mod_sslRed Hat:rhel_software_collections:3::el6 From an advisory covering 38 CVEs |
before 1:2.4.34-7.el6 | 1:2.4.34-7.el6 |
httpd24-nghttp2Red Hat:rhel_software_collections:3::el6 From an advisory covering 38 CVEs |
before 0:1.7.1-7.el6 | 0:1.7.1-7.el6 |
httpd24-nghttp2-debuginfoRed Hat:rhel_software_collections:3::el6 From an advisory covering 38 CVEs |
before 0:1.7.1-7.el6 | 0:1.7.1-7.el6 |
httpd24-curlRed Hat:rhel_software_collections:3::el7 From an advisory covering 38 CVEs |
before 0:7.61.1-1.el7 | 0:7.61.1-1.el7 |
httpd24-curl-debuginfoRed Hat:rhel_software_collections:3::el7 From an advisory covering 38 CVEs |
before 0:7.61.1-1.el7 | 0:7.61.1-1.el7 |
httpd24-httpdRed Hat:rhel_software_collections:3::el7 From an advisory covering 38 CVEs |
before 0:2.4.34-7.el7 | 0:2.4.34-7.el7 |
httpd24-httpd-debuginfoRed Hat:rhel_software_collections:3::el7 From an advisory covering 38 CVEs |
before 0:2.4.34-7.el7 | 0:2.4.34-7.el7 |
httpd24-httpd-develRed Hat:rhel_software_collections:3::el7 From an advisory covering 38 CVEs |
before 0:2.4.34-7.el7 | 0:2.4.34-7.el7 |
httpd24-httpd-manualRed Hat:rhel_software_collections:3::el7 From an advisory covering 38 CVEs |
before 0:2.4.34-7.el7 | 0:2.4.34-7.el7 |
httpd24-httpd-toolsRed Hat:rhel_software_collections:3::el7 From an advisory covering 38 CVEs |
before 0:2.4.34-7.el7 | 0:2.4.34-7.el7 |
httpd24-libcurlRed Hat:rhel_software_collections:3::el7 From an advisory covering 38 CVEs |
before 0:7.61.1-1.el7 | 0:7.61.1-1.el7 |
httpd24-libcurl-develRed Hat:rhel_software_collections:3::el7 From an advisory covering 38 CVEs |
before 0:7.61.1-1.el7 | 0:7.61.1-1.el7 |
httpd24-libnghttp2Red Hat:rhel_software_collections:3::el7 From an advisory covering 38 CVEs |
before 0:1.7.1-7.el7 | 0:1.7.1-7.el7 |
httpd24-libnghttp2-develRed Hat:rhel_software_collections:3::el7 From an advisory covering 38 CVEs |
before 0:1.7.1-7.el7 | 0:1.7.1-7.el7 |
httpd24-mod_ldapRed Hat:rhel_software_collections:3::el7 From an advisory covering 38 CVEs |
before 0:2.4.34-7.el7 | 0:2.4.34-7.el7 |
httpd24-mod_mdRed Hat:rhel_software_collections:3::el7 From an advisory covering 38 CVEs |
before 0:2.4.34-7.el7 | 0:2.4.34-7.el7 |
httpd24-mod_proxy_htmlRed Hat:rhel_software_collections:3::el7 From an advisory covering 38 CVEs |
before 1:2.4.34-7.el7 | 1:2.4.34-7.el7 |
httpd24-mod_sessionRed Hat:rhel_software_collections:3::el7 From an advisory covering 38 CVEs |
before 0:2.4.34-7.el7 | 0:2.4.34-7.el7 |
httpd24-mod_sslRed Hat:rhel_software_collections:3::el7 From an advisory covering 38 CVEs |
before 1:2.4.34-7.el7 | 1:2.4.34-7.el7 |
httpd24-nghttp2Red Hat:rhel_software_collections:3::el7 From an advisory covering 38 CVEs |
before 0:1.7.1-7.el7 | 0:1.7.1-7.el7 |
httpd24-nghttp2-debuginfoRed Hat:rhel_software_collections:3::el7 From an advisory covering 38 CVEs |
before 0:1.7.1-7.el7 | 0:1.7.1-7.el7 |
curlRed Hat:rhel_eus:7.5::computenode From an advisory covering 5 CVEs |
before 0:7.29.0-46.el7_5.1 | 0:7.29.0-46.el7_5.1 |
curl-debuginfoRed Hat:rhel_eus:7.5::computenode From an advisory covering 5 CVEs |
before 0:7.29.0-46.el7_5.1 | 0:7.29.0-46.el7_5.1 |
libcurlRed Hat:rhel_eus:7.5::computenode From an advisory covering 5 CVEs |
before 0:7.29.0-46.el7_5.1 | 0:7.29.0-46.el7_5.1 |
libcurl-develRed Hat:rhel_eus:7.5::computenode From an advisory covering 5 CVEs |
before 0:7.29.0-46.el7_5.1 | 0:7.29.0-46.el7_5.1 |
curlRed Hat:rhel_eus:7.5::server From an advisory covering 5 CVEs |
before 0:7.29.0-46.el7_5.1 | 0:7.29.0-46.el7_5.1 |
curl-debuginfoRed Hat:rhel_eus:7.5::server From an advisory covering 5 CVEs |
before 0:7.29.0-46.el7_5.1 | 0:7.29.0-46.el7_5.1 |
libcurlRed Hat:rhel_eus:7.5::server From an advisory covering 5 CVEs |
before 0:7.29.0-46.el7_5.1 | 0:7.29.0-46.el7_5.1 |
libcurl-develRed Hat:rhel_eus:7.5::server From an advisory covering 5 CVEs |
before 0:7.29.0-46.el7_5.1 | 0:7.29.0-46.el7_5.1 |
curlRed Hat:rhel_aus:7.4::server From an advisory covering 5 CVEs |
before 0:7.29.0-42.el7_4.2 | 0:7.29.0-42.el7_4.2 |
curl-debuginfoRed Hat:rhel_aus:7.4::server From an advisory covering 5 CVEs |
before 0:7.29.0-42.el7_4.2 | 0:7.29.0-42.el7_4.2 |
libcurlRed Hat:rhel_aus:7.4::server From an advisory covering 5 CVEs |
before 0:7.29.0-42.el7_4.2 | 0:7.29.0-42.el7_4.2 |
libcurl-develRed Hat:rhel_aus:7.4::server From an advisory covering 5 CVEs |
before 0:7.29.0-42.el7_4.2 | 0:7.29.0-42.el7_4.2 |
curlRed Hat:rhel_e4s:7.4::server From an advisory covering 5 CVEs |
before 0:7.29.0-42.el7_4.2 | 0:7.29.0-42.el7_4.2 |
curl-debuginfoRed Hat:rhel_e4s:7.4::server From an advisory covering 5 CVEs |
before 0:7.29.0-42.el7_4.2 | 0:7.29.0-42.el7_4.2 |
libcurlRed Hat:rhel_e4s:7.4::server From an advisory covering 5 CVEs |
before 0:7.29.0-42.el7_4.2 | 0:7.29.0-42.el7_4.2 |
libcurl-develRed Hat:rhel_e4s:7.4::server From an advisory covering 5 CVEs |
before 0:7.29.0-42.el7_4.2 | 0:7.29.0-42.el7_4.2 |
curlRed Hat:rhel_tus:7.4::server From an advisory covering 5 CVEs |
before 0:7.29.0-42.el7_4.2 | 0:7.29.0-42.el7_4.2 |
curl-debuginfoRed Hat:rhel_tus:7.4::server From an advisory covering 5 CVEs |
before 0:7.29.0-42.el7_4.2 | 0:7.29.0-42.el7_4.2 |
libcurlRed Hat:rhel_tus:7.4::server From an advisory covering 5 CVEs |
before 0:7.29.0-42.el7_4.2 | 0:7.29.0-42.el7_4.2 |
libcurl-develRed Hat:rhel_tus:7.4::server From an advisory covering 5 CVEs |
before 0:7.29.0-42.el7_4.2 | 0:7.29.0-42.el7_4.2 |
curlSUSE:Studio Onsite 1.3 From an advisory covering 2 CVEs |
before 7.19.7-1.20.53.13.1 | 7.19.7-1.20.53.13.1 |
curlSUSE:Linux Enterprise Desktop 12 SP2 |
before 7.37.0-37.14.1 | 7.37.0-37.14.1 |
curlSUSE:Linux Enterprise Desktop 12 SP3 |
before 7.37.0-37.14.1 | 7.37.0-37.14.1 |
curlSUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 |
before 7.37.0-37.14.1 | 7.37.0-37.14.1 |
curlSUSE:Linux Enterprise Software Development Kit 12 SP2 |
before 7.37.0-37.14.1 | 7.37.0-37.14.1 |
curlSUSE:Linux Enterprise Software Development Kit 12 SP3 |
before 7.37.0-37.14.1 | 7.37.0-37.14.1 |
curlSUSE:Linux Enterprise Server 12 SP2 |
before 7.37.0-37.14.1 | 7.37.0-37.14.1 |
curlSUSE:Linux Enterprise Server for SAP Applications 12 SP2 |
before 7.37.0-37.14.1 | 7.37.0-37.14.1 |
curlSUSE:Linux Enterprise Server 12 SP3 |
before 7.37.0-37.14.1 | 7.37.0-37.14.1 |
curlSUSE:Linux Enterprise Server for SAP Applications 12 SP3 |
before 7.37.0-37.14.1 | 7.37.0-37.14.1 |
curlSUSE:Linux Enterprise Software Development Kit 11 SP4 From an advisory covering 2 CVEs |
before 7.19.7-1.70.13.1 | 7.19.7-1.70.13.1 |
curl-openssl1SUSE:Linux Enterprise Server 11-SECURITY From an advisory covering 2 CVEs |
before 7.19.7-1.70.13.1 | 7.19.7-1.70.13.1 |
curlSUSE:Linux Enterprise Server 11 SP4 From an advisory covering 2 CVEs |
before 7.19.7-1.70.13.1 | 7.19.7-1.70.13.1 |
curlSUSE:Linux Enterprise Server for SAP Applications 11 SP4 From an advisory covering 2 CVEs |
before 7.19.7-1.70.13.1 | 7.19.7-1.70.13.1 |
curlUbuntu:14.04:LTS |
before 7.35.0-1ubuntu2.14, plus listed versions 7.32.0-1ubuntu17.33.0-1ubuntu17.34.0-1ubuntu17.35.0-1ubuntu17.35.0-1ubuntu2 Show 12 moreShow less7.35.0-1ubuntu2.17.35.0-1ubuntu2.27.35.0-1ubuntu2.37.35.0-1ubuntu2.57.35.0-1ubuntu2.67.35.0-1ubuntu2.77.35.0-1ubuntu2.87.35.0-1ubuntu2.97.35.0-1ubuntu2.107.35.0-1ubuntu2.117.35.0-1ubuntu2.127.35.0-1ubuntu2.13 |
7.35.0-1ubuntu2.14 |
curlUbuntu:16.04:LTS |
before 7.47.0-1ubuntu2.6, plus listed versions 7.43.0-1ubuntu27.45.0-1ubuntu17.46.0-1ubuntu17.47.0-1ubuntu17.47.0-1ubuntu2 Show 5 moreShow less7.47.0-1ubuntu2.17.47.0-1ubuntu2.27.47.0-1ubuntu2.37.47.0-1ubuntu2.47.47.0-1ubuntu2.5 |
7.47.0-1ubuntu2.6 |
curlUbuntu:14.04:LTS From an advisory covering 2 CVEs |
before 7.35.0-1ubuntu2.14, plus listed versions 7.32.0-1ubuntu17.33.0-1ubuntu17.34.0-1ubuntu17.35.0-1ubuntu17.35.0-1ubuntu2 Show 12 moreShow less7.35.0-1ubuntu2.17.35.0-1ubuntu2.27.35.0-1ubuntu2.37.35.0-1ubuntu2.57.35.0-1ubuntu2.67.35.0-1ubuntu2.77.35.0-1ubuntu2.87.35.0-1ubuntu2.97.35.0-1ubuntu2.107.35.0-1ubuntu2.117.35.0-1ubuntu2.127.35.0-1ubuntu2.13 |
7.35.0-1ubuntu2.14 |
curlUbuntu:16.04:LTS From an advisory covering 2 CVEs |
before 7.47.0-1ubuntu2.6, plus listed versions 7.43.0-1ubuntu27.45.0-1ubuntu17.46.0-1ubuntu17.47.0-1ubuntu17.47.0-1ubuntu2 Show 5 moreShow less7.47.0-1ubuntu2.17.47.0-1ubuntu2.27.47.0-1ubuntu2.37.47.0-1ubuntu2.47.47.0-1ubuntu2.5 |
7.47.0-1ubuntu2.6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-1000007 is a critical vulnerability (CVSS 9.8) in Haxx Curl, published January 24, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 9.91%, the 95th percentile. Fixed in curl 7.58.0-1.
References
usn.ubuntu.com/3554-2
access.redhat.com/errata/RHSA-2018:3558
debian.org/security/2018/dsa-4098
curl.haxx.se/docs/adv_2018-b3bf.html
securitytracker.com/id/1040274
Show 194 moreShow less
lists.debian.org/debian-lts-announce/2018/01/msg00038.html
oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
openwall.com/lists/oss-security/2022/04/27/4
nvd.nist.gov/vuln/detail/CVE-2018-1000007
github.com/advisories/GHSA-g7x2-hrfp-pv5f
errata.tuxcare.com/els_os/oraclelinux6els/CLSA-2026-1778778961.html
security-tracker.debian.org/tracker/CVE-2018-1000007
bugzilla.redhat.com/show_bug.cgi?id=1510247
security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_3157.json
cve.org/CVERecord?id=CVE-2018-1000007
httpd.apache.org/security/vulnerabilities_24.html
suse.com/support/update/announcement/2018/suse-su-20180214-1
bugzilla.suse.com/1027712
ubuntu.com/security/CVE-2018-1000007
Left out here: 32 references. The JSON record has them.