CVE-2018-1000007: libcurl Credential Leak via Custom Headers on Redirects
libcurl versions 7.1 through 7.57.0 can send custom headers, including Authorization headers, to hosts other than the original one when following HTTP 30X redirects. This can expose authentication data to third parties. NVD scores it CVSS 3.1 9.8 (critical), and the record does not list it in CISA KEV.
Overview
The libcurl advisory describes a flaw where custom HTTP headers are sent beyond the intended host when redirects are followed. According to the record, headers are first sent to the initial URL host and, when a 30X response points elsewhere through the Location header, the same headers can be sent to the new host. The issue is described in the curl security advisory and summarized in the NVD entry.
Impact
- Authentication data carried in custom Authorization headers may reach third-party hosts.
- Exposed headers may contain privacy-sensitive information or allow others to impersonate the client's requests.
- NVD rates the base score 9.8 under CVSS 3.1 (critical), with high confidentiality, integrity and availability impact in its vector.
Affected products and versions
The record lists libcurl versions from 7.1 through 7.57.0 as affected. It also lists several Linux distributions, Red Hat Enterprise Linux releases and Fujitsu M10 and M12 firmware products with version constraints. Some Fujitsu entries use constraint strings whose exact meaning should be confirmed against the vendor advisory.
- libcurl: 7.1 through 7.57.0
- Ubuntu Linux, Debian Linux and Red Hat Enterprise Linux: distribution-specific entries in the record
- Fujitsu M10, M12 and M10-4s firmware: constraint entries in the record
The record does not state an exact fixed upstream libcurl version in the fields provided.
Exploitation status
The CISA KEV field in the record is false, so no confirmed active exploitation appears in the sources consulted for this analysis. The EPSS probability in the record is 0.06578 with a percentile of 0.93694. These values estimate likelihood but do not confirm exploitation.
Remediation and mitigation
- Identify systems that use libcurl in the affected range, including packaged copies supplied by distributions or firmware.
- Apply the vendor fixes that match your platform, using the curl advisory, the Ubuntu notice, the Debian advisory or the Oracle update as applicable.
- If patching is delayed, avoid automatic redirect following for requests that carry sensitive custom headers, and do not pass Authorization headers across untrusted redirects.
- Rotate credentials that may have been exposed if logs or traffic show unexpected cross-host transmission.
Detection guidance
- Review application code and configuration for custom Authorization or other sensitive headers combined with redirect following.
- Monitor for outbound requests carrying sensitive headers to hosts that were not the original destination.
- Track EPSS and KEV status over time, since these may change after publication.
Limitations of the available information
The record does not include the exact fixed libcurl version, a complete list of vendor patch versions or a CNA-provided title. Affected ranges for distributions and firmware are taken from the record as written and were not independently verified. Exploitation status reflects only the sources consulted.
Frequently asked questions
Is this libcurl issue being actively exploited?
The record shows the CISA KEV field as false, so no confirmed active exploitation appears in the sources consulted. The EPSS values in the record estimate likelihood but do not confirm exploitation.
What should I do first?
Identify libcurl instances in the affected range, apply the vendor fix that matches your platform, and avoid sending sensitive custom headers across redirects until patching is complete.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.