CVE-2015-3236
EPSS 8.2%
Description
cURL and libcurl 7.40.0 through 7.42.1 send the HTTP Basic authentication credentials for a previous connection when reusing a reset (curl_easy_reset) connection handle to send a request to the same host name, which allows remote attackers to obtain sensitive information via unspecified vectors.
How to fix CVE-2015-3236
To remediate CVE-2015-3236, upgrade the affected package to a fixed version below.
- Debian/curl—upgrade to 7.43.0-1 or later
Is CVE-2015-3236 being exploited?
Moderate — EPSS is 8.2%. Track this CVE but it's not at the top of the prioritisation list.
Affected packages (1)
- from 0, < 7.43.0-1