Skip to content

Commit

Permalink
CVE-2024-11053.md: adjust the introduced-in data
Browse files Browse the repository at this point in the history
This problem was introduced much later than previously thought, proven
by bisects.

Researched-by: Yihang Zhou
  • Loading branch information
bagder committed Jan 7, 2025
1 parent bd308c4 commit d58e4eb
Show file tree
Hide file tree
Showing 2 changed files with 4 additions and 4 deletions.
6 changes: 3 additions & 3 deletions docs/CVE-2024-11053.md
Original file line number Diff line number Diff line change
Expand Up @@ -47,9 +47,9 @@ Severity: Low
AFFECTED VERSIONS
-----------------

- Affected versions: curl 6.5 to and including 8.11.0
- Not affected versions: curl < 6.5 and >= 8.11.1
- Introduced-in: https://github.com/curl/curl/commit/ae1912cb0d494b48d514
- Affected versions: curl 7.76.0 to and including 8.11.0
- Not affected versions: curl < 7.76.0 and >= 8.11.1
- Introduced-in: https://github.com/curl/curl/commit/46620b97431e19c53ce82e5

libcurl is used by many applications, but not always advertised as such!

Expand Down
2 changes: 1 addition & 1 deletion docs/vuln.pm
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@
#
# List of CWEs => https://cwe.mitre.org/data/definitions/658.html
@vuln = (
"CVE-2024-11053.html|6.5|8.11.0|netrc and redirect credential leak|CVE-2024-11053|20241211|20241108|CWE-200: Exposure of Sensitive Information to an Unauthorized Actor|540|netrc|-|both|low|https://hackerone.com/reports/2829063",
"CVE-2024-11053.html|7.76.0|8.11.0|netrc and redirect credential leak|CVE-2024-11053|20241211|20241108|CWE-200: Exposure of Sensitive Information to an Unauthorized Actor|540|netrc|-|both|low|https://hackerone.com/reports/2829063",
"CVE-2024-9681.html|7.74.0|8.10.1|HSTS subdomain overwrites parent cache entry|CVE-2024-9681|20241105|20241007|CWE-1025: Comparison Using Wrong Factors|540|HSTS|-|both|low|https://hackerone.com/reports/2764830",
"CVE-2024-8096.html|7.41.0|8.9.1|OCSP stapling bypass with GnuTLS|CVE-2024-8096|20240911|20240819|CWE-295: Improper Certificate Validation|2540|TLS|-|both|medium|https://hackerone.com/reports/2669852",
"CVE-2024-7264.html|7.32.0|8.9.0|ASN.1 date parser overread|CVE-2024-7264|20240731|20240730|CWE-125: Out-of-bounds Read|540|ASN1|OVERREAD|both|low|https://hackerone.com/reports/2629968",
Expand Down

0 comments on commit d58e4eb

Please sign in to comment.