curl 7.7 through 7.76.1 suffers from an information...
High severity
Unreviewed
Published
May 24, 2022
to the GitHub Advisory Database
•
Updated Apr 7, 2024
Description
Published by the National Vulnerability Database
Jun 11, 2021
Published to the GitHub Advisory Database
May 24, 2022
Last updated
Apr 7, 2024
curl 7.7 through 7.76.1 suffers from an information disclosure when the
-tcommand line option, known asCURLOPT_TELNETOPTIONSin libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.References