CVE-2024-11053: netrc and redirect credential leak

When asked to both use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances.

This flaw only manifests itself if the netrc file matches the redirect target hostname, but the entry omits password or both login & password.

A curl transfer with a.com that redirects to b.com that uses a .netrc like below (with a match, but no password specified for the second host), would make curl pass on alicespassword as password even in the second transfer to the separate host b.com.

~~~ machine a.com login alice password alicespassword

default login bob ~~~

— Red Hat

When asked to both use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances.

— Launchpad