CVE-2025-0167

When asked to use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a default entry that omits both login and password. A rare circumstance.

• curl 8.12.0+git20250209.89ed161+ds-1 [bookworm] - curl 7.88.1-10+deb12u11 [bullseye] - curl (Vulnerable code introduced later) https://curl.se/docs/CVE-2025-0167.html Introduced with: https://github.com/curl/curl/commit/46620b97431e19c53ce82e55055c85830f088cf4 (curl-7_76_0) Fixed by: https://github.com/curl/curl/commit/0e120c5b925e8ca75d5319e319e5ce4b8080d8eb (curl-8_12_0)