CVE-2024-11053
Publication date 11 December 2024
Last updated 10 July 2026
Ubuntu priority
Description
When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password.
Why is this CVE low priority?
curl developers have rated this issue as low severity
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| curl | 26.04 LTS resolute |
Fixed 8.11.1-1ubuntu1
|
| 24.04 LTS noble |
Fixed 8.5.0-2ubuntu10.6
|
|
| 22.04 LTS jammy |
Fixed 7.81.0-1ubuntu1.20
|
|
| 20.04 LTS focal |
Fixed 7.68.0-1ubuntu2.25
|
|
| 18.04 LTS bionic |
Fixed 7.58.0-2ubuntu3.24+esm10
|
|
| 16.04 LTS xenial |
Fixed 7.47.0-1ubuntu2.19+esm17
|
|
| 14.04 LTS trusty |
Fixed 7.35.0-1ubuntu2.20+esm21
|
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu Pro 30-day free trialSeverity score breakdown
CVSS version: CVSS v3.0
Base score
3.4 · Low
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
References
Related Ubuntu Security Notices (USN)
- USN-7162-1
- curl vulnerability
- 16 December 2024
- USN-8525-1
- curl vulnerabilities
- 9 July 2026