CVE-2011-2192

MEDIO 4.3CVE-2011-2192 · Published 07/07/2011 · updated 16/06/2026

In breve

CVE-2011-2192 è una vulnerabilità MEDIO (CVSS 4.3) che riguarda libcurl (haxx).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 2.9%, superiore al 86.9% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
libcurl haxx	`≥ 7.10.6, ≤ 7.21.6`	No fix yet

Description

The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through 7.21.6, as used in curl and other products, always performs credential delegation during GSSAPI authentication, which allows remote servers to impersonate clients via GSSAPI requests.

References

curl.haxx.se/curl-gssapi-delegation.patch · Broken Link
curl.haxx.se/docs/adv_20110623.html · Vendor Advisory
lists.apple.com/archives/security-announce/2012/Feb/msg00000.html · Mailing List
lists.fedoraproject.org/pipermail/package-announce/2011-July/062287.html · Mailing List
lists.fedoraproject.org/pipermail/package-announce/2011-June/061992.html · Mailing List
secunia.com/advisories/45047 · Third Party Advisory
secunia.com/advisories/45067 · Third Party Advisory
secunia.com/advisories/45088 · Third Party Advisory
secunia.com/advisories/45144 · Third Party Advisory
secunia.com/advisories/45181 · Third Party Advisory
secunia.com/advisories/48256 · Third Party Advisory
security.gentoo.org/glsa/glsa-201203-02.xml

Altre vulnerabilità di libcurl

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

libcurl

haxx

≥ 7.10.6, ≤ 7.21.6

No fix yet

Altre vulnerabilità di libcurl

Vedi tutto →