Ten holes in curl: your passwords can travel to a stranger's server on a redirect

You've stuffed it into a script, a container, a CI pipeline, every Dockerfile that fetches something off the network - and you don't even remember when. curl (a tool for downloading files) is everywhere because nobody installs it on purpose. It's just there. So a patch in curl isn't news about one product. It touches everything we've put into production.

Dead center is the scenario with .netrc. curl can send your credentials (username and password) to a completely different host just because the server returned a redirect. Nobody typed a wrong password. Nobody clicked a phishing link. The automation is just doing its job - and handing passwords to a stranger's server.

The automation doesn't check where it's being redirected. It just executes.

We're updating curl everywhere it exists - servers, container images, CI machines. Ten CVEs sounds scary, but by Ubuntu's own words none of them is being exploited. A patch, not a fire. And as always - if someone tells you something's being exploited, ask for the CVE.

The visual is generated code-art, no third-party images.