Authentication Flaw in Curl Affects Multiple Versions
CVE-2016-8616

3.7LOW

Key Information:

Vendor

The Curl Project

Status
Curl
Vendor
CVE Published:
1 August 2018

What is CVE-2016-8616?

A vulnerability exists in versions of curl prior to 7.51.0, where case insensitive comparisons of usernames and passwords are conducted when reusing connections. This flaw allows an attacker who knows a case-insensitive variation of the correct password to potentially exploit an existing connection with valid credentials. If an unused connection with proper credentials exists for protocols that use connection-scoped credentials, an unauthorized user could gain access by reusing this connection without properly authenticating.

Affected Version(s)

curl 7.51.0

References

http://www.securityfocus.com/bid/94094
vdb-entryx_refsource_BID
https://access.redhat.com/errata/RHSA-2018:3558
vendor-advisoryx_refsource_REDHAT
https://curl.haxx.se/docs/adv_20161102B.html
x_refsource_CONFIRM

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2016-8616 : Authentication Flaw in Curl Affects Multiple Versions