Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CVE-2024-11053.md: update fixes #425

Closed
wants to merge 4 commits into from
Closed
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Next Next commit
CVE-2024-11053.md: update fixes
- Mention that the fix for this CVE, curl/curl@e9b9bba, caused a
  regression that was fixed by curl/curl@9fce2c5.

Bug: curl/curl#15767 (comment)
Reported-by: Dan Fandrich

Closes #xxxxx
jay committed Feb 11, 2025
commit ba451a32db9339a7ab435bef7e6023d71eae1f14
6 changes: 4 additions & 2 deletions docs/CVE-2024-11053.md
Original file line number Diff line number Diff line change
@@ -57,8 +57,10 @@ SOLUTION
------------

- Fixed-in: https://github.com/curl/curl/commit/e9b9bbac22c26cf6731
- Also-apply: https://github.com/curl/curl/commit/9fce2c55d4b0273ac99

The fix also addresses a few other .netrc related issues.
The fix also addresses a few other .netrc related issues. The fix caused a
regression that was fixed by the second commit 9fce2c5.

RECOMMENDATIONS
---------------
@@ -68,7 +70,7 @@ preference:

A - Upgrade curl and libcurl to version 8.11.1

B - Apply the patch to your version and rebuild
B - Apply the patches to your version and rebuild

C - Avoid using netrc together with redirects