CVE-2025-0167

When asked to use a `.netrc` file for credentials **and** to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a `default` entry that omits both login and password. A rare circumstance.

Score

CVSS 3.1 3.4 Low

Status

Modified - 2499f714-1537-4658-8207-48ae4bb9eae9

Published

2025-02-05

Last modified

2026-10-15

Affected products

• Curl (Curl)
• Curl (Haxx)
• Bootstrap Os (Netapp)
• Element Software (Netapp)
• H300s Firmware (Netapp)
• H410c Firmware (Netapp)
• H410s Firmware (Netapp)
• H500s Firmware (Netapp)
• H610c Firmware (Netapp)
• H610s Firmware (Netapp)
• H615c Firmware (Netapp)
• H700s Firmware (Netapp)
• Ontap (Netapp)
• Ontap Select Deploy Administration Utility (Netapp)
• Ontap Tools (Netapp)
• Solidfire & Hci Management Node (Netapp)
• Solidfire & Hci Storage Node (Netapp)
• 12xfo (Siemens)
• 24xsfp (Siemens)
• 2x10g (Siemens)
• 8xfo (Siemens)
• 8xsfp (Siemens)
• Cc (Siemens)
• Ruggedcom Rst2428p (Siemens)
• Scalance Xc-300xr-300xc-400xr-500wgxr-500 Family (Siemens)
• Scalance Xch328 (Siemens)
• Scalance Xcm324 (Siemens)
• Scalance Xcm328 (Siemens)
• Scalance Xcm332 (Siemens)
• Scalance Xrh334 24 V Dc (Siemens)
• Scalance Xrm334 230 V Ac (Siemens)
• Scalance Xrm334 230v Ac (Siemens)
• Scalance Xrm334 24 V Dc (Siemens)
• Scalance Xrm334 24v Dc (Siemens)
• Scalance Xrm334 2x230 V Ac (Siemens)
• Scalance Xrm334 2x230v Ac (Siemens)
• Simatic S7-1500 Cpu 1518-4 Pndp Mfp (Siemens)
• Simatic S7-1500 Cpu 1518f-4 Pndp Mfp (Siemens)
• Siplus S7-1500 Cpu 1518-4 Pndp Mfp (Siemens)

References

• https://curl.se/docs/CVE-2025-0167.json
• https://curl.se/docs/CVE-2025-0167.html
• https://hackerone.com/reports/2917232
• https://security.netapp.com/advisory/ntap-20250306-0008/
• https://cert-portal.siemens.com/productcert/html/ssa-398330.html
• https://cert-portal.siemens.com/productcert/html/ssa-089022.html