CVE-2024-11053 - Vulnerability Details

When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact partial

Vendors	Products
Haxx	Curl
Netapp	Bootstrap Os H300s H300s Firmware H410s H410s Firmware H500s H500s Firmware H610c H610c Firmware H610s H610s Firmware H615c H615c Firmware H700s H700s Firmware Hci Compute Node Ontap Ontap Select Deploy Administration Utility
Redhat	Enterprise Linux

Configuration 1 [-]

cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*

Configuration 2 [-]

OR	cpe:2.3:a:netapp:ontap:9:::::::*
	cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:::::::*

Configuration 3 [-]

AND

cpe:2.3:o:netapp:h610c_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h610c:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:netapp:h610s_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h610s:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:o:netapp:h615c_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h615c:-:*:*:*:*:*:*:*

Configuration 6 [-]

AND

cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*

Configuration 7 [-]

AND

cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*

Configuration 8 [-]

AND

cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

Configuration 9 [-]

AND

cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*

Configuration 10 [-]

AND

cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 8
mysql:8.0-8100020250212154709.489197e6	cpe:/a:redhat:enterprise_linux:8	RHSA-2025:1673	2025-02-19T00:00:00Z
Red Hat Enterprise Linux 9
mysql-0:8.0.41-2.el9_5	cpe:/a:redhat:enterprise_linux:9	RHSA-2025:1671	2025-02-19T00:00:00Z

References

Link	Providers
http://www.openwall.com/lists/oss-security/2024/12/11/1
https://curl.se/docs/CVE-2024-11053.html
https://curl.se/docs/CVE-2024-11053.json
https://hackerone.com/reports/2829063
https://nvd.nist.gov/vuln/detail/CVE-2024-11053
https://security.netapp.com/advisory/ntap-20250124-0012/
https://security.netapp.com/advisory/ntap-20250131-0003/
https://www.cve.org/CVERecord?id=CVE-2024-11053
https://www.oracle.com/security-alerts/cpujan2025.html#AppendixMSQL

History

Wed, 30 Jul 2025 17:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Haxx Haxx curl Netapp Netapp bootstrap Os Netapp h300s Netapp h300s Firmware Netapp h410s Netapp h410s Firmware Netapp h500s Netapp h500s Firmware Netapp h610c Netapp h610c Firmware Netapp h610s Netapp h610s Firmware Netapp h615c Netapp h615c Firmware Netapp h700s Netapp h700s Firmware Netapp hci Compute Node Netapp ontap Netapp ontap Select Deploy Administration Utility
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:a:haxx:curl:::::::: cpe:2.3:a:netapp:ontap:9:::::::* cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:::::::* cpe:2.3:h:netapp:h300s:-:::::::* cpe:2.3:h:netapp:h410s:-:::::::* cpe:2.3:h:netapp:h500s:-:::::::* cpe:2.3:h:netapp:h610c:-:::::::* cpe:2.3:h:netapp:h610s:-:::::::* cpe:2.3:h:netapp:h615c:-:::::::* cpe:2.3:h:netapp:h700s:-:::::::* cpe:2.3:h:netapp:hci_compute_node:-:::::::* cpe:2.3:o:netapp:bootstrap_os:-:::::::* cpe:2.3:o:netapp:h300s_firmware:-:::::::* cpe:2.3:o:netapp:h410s_firmware:-:::::::* cpe:2.3:o:netapp:h500s_firmware:-:::::::* cpe:2.3:o:netapp:h610c_firmware:-:::::::* cpe:2.3:o:netapp:h610s_firmware:-:::::::* cpe:2.3:o:netapp:h615c_firmware:-:::::::* cpe:2.3:o:netapp:h700s_firmware:-:::::::*
Vendors & Products		Haxx Haxx curl Netapp Netapp bootstrap Os Netapp h300s Netapp h300s Firmware Netapp h410s Netapp h410s Firmware Netapp h500s Netapp h500s Firmware Netapp h610c Netapp h610c Firmware Netapp h610s Netapp h610s Firmware Netapp h615c Netapp h615c Firmware Netapp h700s Netapp h700s Firmware Netapp hci Compute Node Netapp ontap Netapp ontap Select Deploy Administration Utility

Wed, 16 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00167}`	epss `{'score': 0.00187}`

Thu, 20 Feb 2025 02:15:00 +0000

Type	Values Removed	Values Added
CPEs		cpe:/a:redhat:enterprise_linux:8

Wed, 19 Feb 2025 14:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Redhat Redhat enterprise Linux
CPEs		cpe:/a:redhat:enterprise_linux:9
Vendors & Products		Redhat Redhat enterprise Linux

Thu, 13 Feb 2025 00:45:00 +0000

Type	Values Removed	Values Added
References		https://www.oracle.com/security-alerts/cpujan2025.html#AppendixMSQL

Fri, 31 Jan 2025 15:30:00 +0000

Type	Values Removed	Values Added
References		https://security.netapp.com/advisory/ntap-20250131-0003/

Fri, 24 Jan 2025 20:45:00 +0000

Type	Values Removed	Values Added
References		https://security.netapp.com/advisory/ntap-20250124-0012/

Sun, 15 Dec 2024 17:15:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`	cvssV3_1 `{'score': 3.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 12 Dec 2024 13:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-200
References		https://nvd.nist.gov/vuln/detail/CVE-2024-11053 https://www.cve.org/CVERecord?id=CVE-2024-11053
Metrics	threat_severity `None`	threat_severity `Low`

Wed, 11 Dec 2024 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 11 Dec 2024 10:45:00 +0000

Type	Values Removed	Values Added
References		http://www.openwall.com/lists/oss-security/2024/12/11/1

Wed, 11 Dec 2024 07:45:00 +0000

Type	Values Removed	Values Added
Description		When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password.
Title		netrc and redirect credential leak
References		https://curl.se/docs/CVE-2024-11053.html https://curl.se/docs/CVE-2024-11053.json https://hackerone.com/reports/2829063

MITRE

Status: PUBLISHED

Assigner: curl

Published: 2024-12-11T07:34:29.539Z

Updated: 2025-01-31T15:02:42.742Z

Reserved: 2024-11-09T18:41:55.703Z

Link: CVE-2024-11053

Vulnrichment

Updated: 2025-01-31T15:02:42.742Z

NVD

Status : Analyzed

Published: 2024-12-11T08:15:05.307

Modified: 2025-07-30T17:39:25.437

Link: CVE-2024-11053

Redhat

Severity : Low

Publid Date: 2024-12-11T00:00:00Z

Links: CVE-2024-11053 - Bugzilla

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction Required

Exploitation poc

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object