Vulnerability Description
curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '#' character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC to check for allowed domains before using curl to request them.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Haxx | Curl | < 7.51.0 |
Related Weaknesses (CWE)
References
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- http://www.securityfocus.com/bid/94103Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1037192Third Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2018:2486Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:3558
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8624Issue TrackingPatchThird Party Advisory
- https://curl.haxx.se/docs/adv_20161102J.htmlPatchVendor Advisory
- https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e3
- https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8
- https://lists.apache.org/thread.html/rfaa4d578587f52a9c4d176af516a681a712c664e3b
- https://security.gentoo.org/glsa/201701-47Third Party Advisory
- https://www.tenable.com/security/tns-2016-21Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- http://www.securityfocus.com/bid/94103Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1037192Third Party AdvisoryVDB Entry
FAQ
What is CVE-2016-8624?
CVE-2016-8624 is a vulnerability with a CVSS score of 5.3 (MEDIUM). curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '#' character, and could instead be tricked into connecting to a different hos...
How severe is CVE-2016-8624?
CVE-2016-8624 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2016-8624?
Check the references section above for vendor advisories and patch information. Affected products include: Haxx Curl.