CVE-2024-11053

Published: Dec 11, 2024Modified: Jun 17, 2026

3.4

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N

Exploitability: 1.6 / Impact: 1.4

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password.

Affected (11)

Products: Haxx: Curl · Netapp: Ontap, Ontap Select Deploy Administration Utility, H610c Firmware, H610s Firmware, H615c Firmware, H700s Firmware, Bootstrap Os, H300s Firmware, H410s Firmware, H500s Firmware

1 product

10 products

Ontap Select Deploy Administration Utility

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Haxx Curl	From 7.76.0 to 8.11.1

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Netapp Ontap	Version 9
Netapp Ontap Select Deploy Administration Utility	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H610c Firmware	All versions

Running on/with	Platform Versions
Netapp H610c	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H610s Firmware	All versions

Running on/with	Platform Versions
Netapp H610s	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H615c Firmware	All versions

Running on/with	Platform Versions
Netapp H615c	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H700s Firmware	All versions

Running on/with	Platform Versions
Netapp H700s	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp Bootstrap Os	All versions

Running on/with	Platform Versions
Netapp Hci Compute Node	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H300s Firmware	All versions

Running on/with	Platform Versions
Netapp H300s	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H410s Firmware	All versions

Running on/with	Platform Versions
Netapp H410s	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H500s Firmware	All versions

Running on/with	Platform Versions
Netapp H500s	All versions

References (7)

https://curl.se/docs/CVE-2024-11053.html

Source: 2499f714-1537-4658-8207-48ae4bb9eae9

Vendor Advisory

https://curl.se/docs/CVE-2024-11053.json

Source: 2499f714-1537-4658-8207-48ae4bb9eae9

Vendor Advisory

https://hackerone.com/reports/2829063

Source: 2499f714-1537-4658-8207-48ae4bb9eae9

ExploitIssue TrackingThird Party Advisory

http://www.openwall.com/lists/oss-security/2024/12/11/1

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://security.netapp.com/advisory/ntap-20250124-0012/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://security.netapp.com/advisory/ntap-20250131-0003/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://security.netapp.com/advisory/ntap-20250131-0004/

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.