| Package | Affected versions | Patched versions |
|---|---|---|
| libcurl | ≥ 7.22.0, ≤ 7.88.1 | |
| ontap | = 9 | |
| universal forwarder | = 9.1.0≥ 8.2.0, < 8.2.12≥ 9.0.0, < 9.0.6 | 8.2.129.0.6 |
An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI transfers and could potentially result in unauthorized access to sensitive information. The safest option is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free