{"id":"CVE-2018-1000007","aliases":["CLSA-2026-1778778961","CLSA-2026-1778786567","CURL-CVE-2018-1000007","DEBIAN-CVE-2018-1000007","DLA-1263-1","DSA-4098-1","EUVD-2018-1778","GHSA-g7x2-hrfp-pv5f","RHSA-2018:3157","RHSA-2018:3558","RHSA-2020:0544","RHSA-2020:0594","SUSE-SU-2018:0214-1","SUSE-SU-2018:0217-1","SUSE-SU-2018:0230-1","UBUNTU-CVE-2018-1000007","USN-3554-1"],"status":"published","title":"libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When...","description":"libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the `Location:` response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom `Authorization:` headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.09906,"percentile":0.95646,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2018-01-24T00:00:00Z","modified":"2026-10-25T01:04:49Z","fixes":[{"ecosystem":"Debian:12","package":"curl","fixed_in":["7.58.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"curl","fixed_in":["7.58.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["7.58.0-1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"curl","fixed_in":["7.26.0-1+wheezy24"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"curl","fixed_in":["7.38.0-4+deb8u9"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"curl","fixed_in":["7.52.1-5+deb9u4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"curl","fixed_in":["7.37.0-37.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"curl","fixed_in":["7.37.0-37.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"curl","fixed_in":["7.37.0-37.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"curl","fixed_in":["7.37.0-37.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"curl","fixed_in":["7.37.0-37.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"curl","fixed_in":["7.37.0-37.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"curl","fixed_in":["7.37.0-37.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"curl","fixed_in":["7.37.0-37.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"curl","fixed_in":["7.37.0-37.14.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"curl","fixed_in":["7.35.0-1ubuntu2.14"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"curl","fixed_in":["7.47.0-1ubuntu2.6"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.19.7-59.el6.tuxcare.els16"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.19.7-59.el6.tuxcare.els16"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.19.7-59.el6.tuxcare.els16"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.19.7-59.el6.tuxcare.els16"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.19.7-59.el6.tuxcare.els16"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.19.7-59.el6.tuxcare.els16"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.58.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.58.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.58.0-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.26.0-1+wheezy24"}]}],"versions":["7.26.0-1+wheezy10","7.26.0-1+wheezy11","7.26.0-1+wheezy12","7.26.0-1+wheezy13","7.26.0-1+wheezy14","7.26.0-1+wheezy15","7.26.0-1+wheezy16","7.26.0-1+wheezy17","7.26.0-1+wheezy18","7.26.0-1+wheezy19","7.26.0-1+wheezy2","7.26.0-1+wheezy20","7.26.0-1+wheezy21","7.26.0-1+wheezy22","7.26.0-1+wheezy23","7.26.0-1+wheezy3","7.26.0-1+wheezy4","7.26.0-1+wheezy5","7.26.0-1+wheezy6","7.26.0-1+wheezy7","7.26.0-1+wheezy8","7.26.0-1+wheezy9"]},{"source":"osv","ecosystem":"Debian:8","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.38.0-4+deb8u9"}]}],"versions":["7.38.0-4","7.38.0-4+deb8u1","7.38.0-4+deb8u2","7.38.0-4+deb8u3","7.38.0-4+deb8u4","7.38.0-4+deb8u5","7.38.0-4+deb8u6","7.38.0-4+deb8u7","7.38.0-4+deb8u8"]},{"source":"osv","ecosystem":"Debian:9","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.52.1-5+deb9u4"}]}],"versions":["7.52.1-5","7.52.1-5+deb9u1","7.52.1-5+deb9u2","7.52.1-5+deb9u3"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-51.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-51.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-51.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"nss-pem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.3-5.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"nss-pem-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.3-5.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-51.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-51.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-51.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-51.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"nss-pem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.3-5.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"nss-pem-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.3-5.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-51.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-51.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-51.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-51.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-51.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"nss-pem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.3-5.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"nss-pem-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.3-5.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-51.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-51.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-51.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-51.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"nss-pem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.3-5.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"nss-pem-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.3-5.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-1.el6"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-1.el6"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-7.el6"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-7.el6"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-7.el6"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-7.el6"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-7.el6"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-1.el6"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-1.el6"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-libnghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.1-7.el6"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-libnghttp2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.1-7.el6"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-7.el6"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.34-7.el6"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-7.el6"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.34-7.el6"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.1-7.el6"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-nghttp2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.1-7.el6"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-1.el7"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-1.el7"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-7.el7"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-7.el7"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-7.el7"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-7.el7"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-7.el7"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-1.el7"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-1.el7"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-libnghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.1-7.el7"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-libnghttp2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.1-7.el7"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-7.el7"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-mod_md","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-7.el7"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.34-7.el7"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-7.el7"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.34-7.el7"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.1-7.el7"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-nghttp2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.1-7.el7"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.5::computenode","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-46.el7_5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.5::computenode","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-46.el7_5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.5::computenode","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-46.el7_5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.5::computenode","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-46.el7_5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.5::server","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-46.el7_5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.5::server","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-46.el7_5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.5::server","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-46.el7_5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.5::server","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-46.el7_5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_aus:7.4::server","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-42.el7_4.2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_aus:7.4::server","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-42.el7_4.2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_aus:7.4::server","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-42.el7_4.2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_aus:7.4::server","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-42.el7_4.2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:7.4::server","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-42.el7_4.2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:7.4::server","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-42.el7_4.2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:7.4::server","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-42.el7_4.2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:7.4::server","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-42.el7_4.2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_tus:7.4::server","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-42.el7_4.2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_tus:7.4::server","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-42.el7_4.2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_tus:7.4::server","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-42.el7_4.2"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_tus:7.4::server","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-42.el7_4.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Studio Onsite 1.3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.19.7-1.20.53.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-37.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-37.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-37.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-37.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-37.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-37.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-37.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-37.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-37.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.19.7-1.70.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11-SECURITY","package":"curl-openssl1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.19.7-1.70.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.19.7-1.70.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.19.7-1.70.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.35.0-1ubuntu2.14"}]}],"versions":["7.32.0-1ubuntu1","7.33.0-1ubuntu1","7.34.0-1ubuntu1","7.35.0-1ubuntu1","7.35.0-1ubuntu2","7.35.0-1ubuntu2.1","7.35.0-1ubuntu2.2","7.35.0-1ubuntu2.3","7.35.0-1ubuntu2.5","7.35.0-1ubuntu2.6","7.35.0-1ubuntu2.7","7.35.0-1ubuntu2.8","7.35.0-1ubuntu2.9","7.35.0-1ubuntu2.10","7.35.0-1ubuntu2.11","7.35.0-1ubuntu2.12","7.35.0-1ubuntu2.13"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.6"}]}],"versions":["7.43.0-1ubuntu2","7.45.0-1ubuntu1","7.46.0-1ubuntu1","7.47.0-1ubuntu1","7.47.0-1ubuntu2","7.47.0-1ubuntu2.1","7.47.0-1ubuntu2.2","7.47.0-1ubuntu2.3","7.47.0-1ubuntu2.4","7.47.0-1ubuntu2.5"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.35.0-1ubuntu2.14"}]}],"versions":["7.32.0-1ubuntu1","7.33.0-1ubuntu1","7.34.0-1ubuntu1","7.35.0-1ubuntu1","7.35.0-1ubuntu2","7.35.0-1ubuntu2.1","7.35.0-1ubuntu2.2","7.35.0-1ubuntu2.3","7.35.0-1ubuntu2.5","7.35.0-1ubuntu2.6","7.35.0-1ubuntu2.7","7.35.0-1ubuntu2.8","7.35.0-1ubuntu2.9","7.35.0-1ubuntu2.10","7.35.0-1ubuntu2.11","7.35.0-1ubuntu2.12","7.35.0-1ubuntu2.13"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.6"}]}],"versions":["7.43.0-1ubuntu2","7.45.0-1ubuntu1","7.46.0-1ubuntu1","7.47.0-1ubuntu1","7.47.0-1ubuntu2","7.47.0-1ubuntu2.1","7.47.0-1ubuntu2.2","7.47.0-1ubuntu2.3","7.47.0-1ubuntu2.4","7.47.0-1ubuntu2.5"],"bundled":2}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fujitsu","product":"m10-1_firmware"},{"vendor":"fujitsu","product":"m10-4_firmware"},{"vendor":"fujitsu","product":"m10-4s_firmware"},{"vendor":"fujitsu","product":"m12-1_firmware"},{"vendor":"fujitsu","product":"m12-2_firmware"},{"vendor":"fujitsu","product":"m12-2s_firmware"},{"vendor":"haxx","product":"curl"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_server_aus"},{"vendor":"redhat","product":"enterprise_linux_server_eus"},{"vendor":"redhat","product":"enterprise_linux_workstation"}],"references":[{"url":"https://usn.ubuntu.com/3554-2/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/3554-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3558","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2018/dsa-4098","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://curl.haxx.se/docs/adv_2018-b3bf.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix","article","report"]},{"url":"http://www.securitytracker.com/id/1040274","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3157","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/01/msg00038.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHBA-2019:0327","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1543","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0544","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0594","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2022/04/27/4","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000007","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-g7x2-hrfp-pv5f"},{"url":"https://errata.tuxcare.com/els_os/oraclelinux6els/CLSA-2026-1778778961.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos6els/CLSA-2026-1778786567.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-1000007","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.6_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1510247","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1537125","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1542256","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1552628","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1552631","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1553398","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1575536","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1610998","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_3157.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1000007","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1000007","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1000120","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1000120","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000120","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_2018-9cd6.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1000121","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1000121","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000121","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_2018-97a2.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1000122","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1000122","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000122","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_2018-b047.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1000301","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1000301","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000301","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_2018-b138.html","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_software_collections/3/html/3.2_release_notes/chap-rhscl#sect-RHSCL-Changes-httpd","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1362183","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1362190","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1362199","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1373229","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1375906","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1388370","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1388371","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1388377","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1388378","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1388379","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1388382","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1388385","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1388386","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1388388","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1388390","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1388392","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1406712","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1439190","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1478309","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1478310","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1495541","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1503705","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1515757","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1515760","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1518737","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1540167","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1558450","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1560395","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1560399","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1560599","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1560614","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1560634","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1560643","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1605048","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1622707","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1628389","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1633260","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1633399","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1634830","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1640722","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1646937","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1648928","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_3558.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5419","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5419","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5419","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_20160803A.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5420","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5420","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5420","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_20160803B.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5421","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5421","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5421","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_20160803C.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7141","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7141","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7141","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_20160907.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7167","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7167","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7167","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_20160914.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-8615","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-8615","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-8615","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_20161102A.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-8616","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-8616","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-8616","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_20161102B.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-8617","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-8617","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-8617","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_20161102C.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-8618","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-8618","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-8618","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_20161102D.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-8619","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-8619","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-8619","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_20161102E.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-8620","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-8620","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-8620","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_20161102F.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-8621","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-8621","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-8621","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_20161102G.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-8622","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-8622","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-8622","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_20161102H.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-8623","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-8623","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-8623","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_20161102I.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-8624","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-8624","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-8624","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_20161102J.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-8625","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-8625","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-8625","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_20161102K.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-9586","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-9586","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9586","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_20161221A.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-7407","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-7407","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-7407","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_20170403.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-8816","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-8816","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-8816","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_2017-12e7.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-8817","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-8817","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-8817","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_2017-ae72.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-15710","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-15710","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-15710","tags":["advisory"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-15715","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-15715","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-15715","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-1000100","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-1000100","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000100","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_20170809B.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-1000101","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-1000101","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000101","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_20170809A.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-1000254","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-1000254","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000254","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_20171004.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-1000257","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-1000257","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000257","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_20171023.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1283","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1283","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1283","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1301","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1301","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1301","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1303","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1303","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1303","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1312","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1312","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1312","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1333","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1333","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1333","tags":["advisory"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2018-1333","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-11763","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-11763","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-11763","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-14618","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-14618","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-14618","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/CVE-2018-14618.html","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0544.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0594.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180214-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1027712","tags":["report"]},{"url":"https://bugzilla.suse.com/1061876","tags":["report"]},{"url":"https://bugzilla.suse.com/1077001","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000007","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180217-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180230-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7141","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-1000007","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3554-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3554-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-1000005","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-1000007","description":"libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the `Location:` response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom `Authorization:` headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request.","status":"published","published":"2018-01-24T22:00:00Z","modified":"2024-08-05T12:33:48.439Z","updated_at":"2026-11-02T14:35:10.313768Z"}],"euvd":[{"id":"EUVD-2018-1778","description":"libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the `Location:` response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom `Authorization:` headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request.","status":"published","published":"2018-01-24T22:00:00Z","modified":"2024-08-05T12:33:48Z","updated_at":"2026-11-03T02:39:27.400094Z"}],"ghsa":[{"id":"GHSA-g7x2-hrfp-pv5f","title":"libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When...","description":"libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the `Location:` response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom `Authorization:` headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request.","status":"published","published":"2022-04-30T00:02:20Z","modified":"2023-01-27T05:02:24Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T14:42:03.063922Z"}],"nvd":[{"id":"CVE-2018-1000007","description":"libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the `Location:` response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom `Authorization:` headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request.","status":"published","published":"2018-01-24T22:29:00.353Z","modified":"2026-06-17T01:32:11.74Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:04:22.897995Z"}],"osv":[{"id":"CVE-2018-1000007","description":"libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the `Location:` response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom `Authorization:` headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request.","status":"published","published":"2018-01-24T22:29:00.353Z","modified":"2026-10-24T10:30:43.944814469Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:07.192756Z"},{"id":"DEBIAN-CVE-2018-1000007","description":"libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the `Location:` response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom `Authorization:` headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request.","status":"published","published":"2018-01-24T22:29:00.353Z","modified":"2026-10-23T18:03:17.214137658Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:29.988046Z"},{"id":"RHSA-2018:3157","title":"Red Hat Security Advisory: curl and nss-pem security and bug fix update","status":"published","published":"2024-09-13T16:54:07Z","modified":"2026-09-21T10:02:02Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"RHSA-2018:3558","title":"Red Hat Security Advisory: httpd24 security, bug fix, and enhancement update","status":"published","published":"2024-09-13T16:54:33Z","modified":"2026-09-21T10:02:03Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"RHSA-2020:0544","title":"Red Hat Security Advisory: curl security update","status":"published","published":"2024-09-13T16:58:36Z","modified":"2026-09-21T10:02:30Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:0594","title":"Red Hat Security Advisory: curl security update","status":"published","published":"2024-09-13T16:58:56Z","modified":"2026-09-21T10:02:31Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"UBUNTU-CVE-2018-1000007","description":"libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the `Location:` response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom `Authorization:` headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request.","status":"published","published":"2018-01-24T00:00:00Z","modified":"2026-04-22T11:39:23.717424Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:16.154988Z"},{"id":"CLSA-2026-1778778961","title":"curl: Fix of 2 CVEs","description":"- CVE-2018-1000120: fix buffer overflow exists in the FTP URL handling\n- CVE-2018-1000007: fix leak authentication data to third parties in HTTP requests","status":"published","published":"2026-05-14T20:17:07Z","modified":"2026-10-21T10:48:18.253539057Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1778786567","title":"curl: Fix of 2 CVEs","description":"- CVE-2018-1000120: fix buffer overflow exists in the FTP URL handling\n- CVE-2018-1000007: fix leak authentication data to third parties in HTTP requests","status":"published","published":"2026-05-14T19:22:52Z","modified":"2026-10-21T10:47:52.967297811Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CURL-CVE-2018-1000007","title":"HTTP authentication leak in redirects","description":"curl might leak authentication data to third parties.\n\nWhen asked to send custom headers in its HTTP requests, curl sends that set of\nheaders first to the host in the initial URL but also, if asked to follow\nredirects and a 30X HTTP response code is returned, to the host mentioned in\nURL in the `Location:` response header value.\n\nSending the same set of headers to subsequent hosts is in particular a problem\nfor applications that pass on custom `Authorization:` headers, as this header\noften contains privacy sensitive information or data that could allow others\nto impersonate the curl-using client's request.","status":"published","published":"2018-01-24T08:00:00Z","modified":"2026-10-25T01:04:49.290884787Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"DLA-1263-1","title":"curl - security update","status":"published","published":"2018-01-29T00:00:00Z","modified":"2026-03-09T01:01:01.177371Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DSA-4098-1","title":"curl - security update","status":"published","published":"2018-01-26T00:00:00Z","modified":"2026-03-09T01:19:11.918068Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"SUSE-SU-2018:0214-1","title":"Security update for curl","description":"This update for curl fixes several issues.\n\nThese security issues were fixed:\n\n- CVE-2017-1000254: Fix FTP PWD response parser out of bounds read (bsc#1061876).\n- CVE-2018-1000007: Prevent leaking authentication data to third parties when\n  following redirects (bsc#1077001)\n\nAlso the following adjustment was made:\n\n- Set DEFAULT_SUSE as the default cipher list (bsc#1027712)\n","status":"published","published":"2018-01-25T08:36:01Z","modified":"2026-02-04T02:33:56.952623Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"SUSE-SU-2018:0217-1","title":"Security update for curl","description":"This update for curl fixes one issues.\n\nThis security issue was fixed:\n\n- CVE-2018-1000007: Prevent leaking authentication data to third parties when following redirects (bsc#1077001)\n","status":"published","published":"2018-01-25T12:39:05Z","modified":"2026-02-04T03:30:51.197347Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"SUSE-SU-2018:0230-1","title":"Security update for curl","description":"This update for curl several issues.\n\nThis security issue was fixed:\n\n- CVE-2018-1000007: Prevent leaking authentication data to third parties when following redirects (bsc#1077001)\n\nThis non-security issue was fixed:\n\n- Set DEFAULT_SUSE as the default cipher list (bsc#1027712]\n","status":"published","published":"2018-01-26T07:47:47Z","modified":"2026-02-04T03:23:07.759471Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"USN-3554-1","title":"curl vulnerabilities","description":"It was discovered that curl incorrectly handled certain data. An attacker\ncould possibly use this to cause a denial of service or even to get access\nto sensitive data. This issue only affected Ubuntu 16.04 LTS and Ubuntu 17.10.\n\nIt was discovered that curl could accidentally leak authentication data.\nAn attacker could possibly use this to get access to sensitive information.\n(CVE-2018-1000007)\n","status":"published","published":"2018-01-31T22:17:35Z","modified":"2026-04-22T09:45:01.186121Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}