CVE-2011-2192
Fixed in a distro release EPSS 3%
The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through 7.21.6, as used in curl and other products, always performs credential delegation during GSSAPI authentication, which allows remote servers to impersonate clients via GSSAPI requests.
Products: haxx libcurl, apple mac_os_x, fedoraproject fedora, debian_linux, canonical ubuntu_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | curl | 7.21.6-2 |
| Debian 13 | curl | 7.21.6-2 |
| Debian 14 | curl | 7.21.6-2 |
| Debian 5.0 | curl | 7.18.2-8lenny5 |
| Debian 6.0 | curl | 7.21.0-2 |
| Red Hat Enterprise Linux 4 | curl | 0:7.12.1-17.el4 |
| Red Hat Enterprise Linux 4 | curl-debuginfo | 0:7.12.1-17.el4 |
| Red Hat Enterprise Linux 4 | curl-devel | 0:7.12.1-17.el4 |
| Red Hat Enterprise Linux 5 | curl | 0:7.15.5-9.el5_6.3 |
| Red Hat Enterprise Linux 5 | curl-debuginfo | 0:7.15.5-9.el5_6.3 |
| Red Hat Enterprise Linux 5 | curl-devel | 0:7.15.5-9.el5_6.3 |
| Red Hat Enterprise Linux 6 | curl | 0:7.19.7-26.el6_1.1 |
| Red Hat Enterprise Linux 6 | curl-debuginfo | 0:7.19.7-26.el6_1.1 |
| Red Hat Enterprise Linux 6 | libcurl | 0:7.19.7-26.el6_1.1 |
| Red Hat Enterprise Linux 6 | libcurl-devel | 0:7.19.7-26.el6_1.1 |