| Release Date: | 2018-08-01 |
A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons of user name and password with the existing connections. This means that if an unused connection with proper credentials exists for a protocol that has connection-scoped credentials, an attacker can cause that connection to be reused if s/he knows the case-insensitive version of the correct password.
See more information about CVE-2016-8616 from MITRE CVE dictionary and NIST NVD
NOTE: The following CVSS v3.0 metrics and score provided are preliminary and subject to review.
| Base Score: | 5.9 | Base Metrics: | AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N |
| Access Vector: | Network | Attack Complexity: | High |
| Privileges Required: | None | User Interaction: | None |
| Scope: | Unchanged | Confidentiality Impact: | None |
| Integrity Impact: | High | Availability Impact: | None |
| Platform | Errata | Release Date |
| Oracle Linux version 6 (curl) | ELSA-2019-4652 | 2019-05-21 |
| Oracle Linux version 7 (curl) | ELSA-2019-4652 | 2019-05-21 |
This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team