CVE-2016-8625

curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and unknowingly issue network transfer requests to the wrong host.

Score

CVSS 3.0 7.5 High

Status

Modified - secalert@redhat.com

Published

2018-08-01

Last modified

2024-08-06

Weaknesses

CWE-20

Affected products

• Curl (Haxx)
• Curl (The Curl Project)

References

• http://www.securityfocus.com/bid/94107
• http://www.securitytracker.com/id/1037192
• https://access.redhat.com/errata/RHSA-2018:2486
• https://access.redhat.com/errata/RHSA-2018:3558
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8625
• https://curl.haxx.se/CVE-2016-8625.patch
• https://curl.haxx.se/docs/adv_20161102K.html
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.a…
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.a…
• https://security.gentoo.org/glsa/201701-47
• https://www.tenable.com/security/tns-2016-21