CVE-2011-2192

The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through 7.21.6, as used in curl and other products, always performs credential delegation during GSSAPI authentication, which allows remote servers to impersonate clients via GSSAPI requests.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.3 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:P/I:N/A:N
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 80%
VendorProductVersion
haxxlibcurl
7.10.6 ≤
𝑥
≤ 7.21.6
applemac_os_x
𝑥
< 10.7.3
debiandebian_linux
5.0
debiandebian_linux
6.0
debiandebian_linux
7.0
canonicalubuntu_linux
8.04
canonicalubuntu_linux
10.04
canonicalubuntu_linux
10.10
canonicalubuntu_linux
11.04
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
curl
bullseye
7.74.0-1.3+deb11u13
fixed
bullseye (security)
7.74.0-1.3+deb11u11
fixed
bookworm
7.88.1-10+deb12u7
fixed
bookworm (security)
7.88.1-10+deb12u5
fixed
sid
8.10.1-2
fixed
trixie
8.10.1-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
curl
natty
Fixed 7.21.3-1ubuntu1.2
released
maverick
Fixed 7.21.0-1ubuntu1.1
released
lucid
Fixed 7.19.7-1ubuntu1.1
released
hardy
Fixed 7.18.0-1ubuntu2.3
released
Common Weakness Enumeration
References
http://curl.haxx.se/curl-gssapi-delegation.patch
http://curl.haxx.se/docs/adv_20110623.html
http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html
http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062287.html
http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061992.html
http://secunia.com/advisories/45047
http://secunia.com/advisories/45067
http://secunia.com/advisories/45088
http://secunia.com/advisories/45144
http://secunia.com/advisories/45181
http://secunia.com/advisories/48256
http://security.gentoo.org/glsa/glsa-201203-02.xml
http://support.apple.com/kb/HT5130
http://www.debian.org/security/2011/dsa-2271
http://www.mandriva.com/security/advisories?name=MDVSA-2011:116
http://www.redhat.com/support/errata/RHSA-2011-0918.html
http://www.securitytracker.com/id?1025713
http://www.ubuntu.com/usn/USN-1158-1
https://bugzilla.redhat.com/show_bug.cgi?id=711454
http://curl.haxx.se/curl-gssapi-delegation.patch
http://curl.haxx.se/docs/adv_20110623.html
http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html
http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062287.html
http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061992.html
http://secunia.com/advisories/45047
http://secunia.com/advisories/45067
http://secunia.com/advisories/45088
http://secunia.com/advisories/45144
http://secunia.com/advisories/45181
http://secunia.com/advisories/48256
http://security.gentoo.org/glsa/glsa-201203-02.xml
http://support.apple.com/kb/HT5130
http://www.debian.org/security/2011/dsa-2271
http://www.mandriva.com/security/advisories?name=MDVSA-2011:116
http://www.redhat.com/support/errata/RHSA-2011-0918.html
http://www.securitytracker.com/id?1025713
http://www.ubuntu.com/usn/USN-1158-1
https://bugzilla.redhat.com/show_bug.cgi?id=711454