UBUNTU-CVE-2018-1000007

    Dashboard / Vulnerabilities / UBUNTU-CVE-2018-1000007

    UBUNTU-CVE-2018-1000007

    Published: 24 Jan 2018Last Modified: 22 Apr 2026

    Summary:

    Details: libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the `Location:` response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom `Authorization:` headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request.

    References: https://ubuntu.com/security/CVE-2018-1000007, https://curl.haxx.se/docs/adv_2018-b3bf.html, https://ubuntu.com/security/notices/USN-3554-1, https://ubuntu.com/security/notices/USN-3554-2, https://www.cve.org/CVERecord?id=CVE-2018-1000007

    Affected packages

    Package

    Name: curl

    Purl: pkg:deb/ubuntu/[email protected]?arch=source&distro=trusty

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -7.35.0-1ubuntu2.14

    Affected versions

    7.32.0-1ubuntu1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High