CVE and update status of the FreeBSD ports tree4,526 unaddressed CVEs in 616 portsAll times are CET

CVE details

CVE-2016-8624

curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '#' character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC to check for allowed domains before using curl to request them.

Score
5.3 medium
Published
2018-07-31
Links
NVD · cve.org

Affected ports (1)

PortPackageVersionStatusMaintainer
ftp/linux-c7-curllinux-c7-curl7.29.0_13unaddressedemulation@FreeBSD.org

VuXML

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>linux-c7-curl</name>
	<range><lt>7.51.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>curl before version 7.51.0 doesn't parse the authority component of
	the URL correctly when the host name part ends with a '#' character,
	and could instead be tricked into connecting to a different host. This
	may have security implications if you for example use an URL parser
	that follows the RFC to check for allowed domains before using curl to
	request them.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2016-8624</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2016-8624</url>
    </references>
    <dates>
      <discovery>2018-07-31</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>