CVE-2025-0167: 
cURL vulnerability analysis and mitigation

CVE-2025-0167 is a security vulnerability discovered in curl versions 7.76.0 through 8.11.1. The vulnerability involves a credential leakage issue where curl could expose passwords when using a .netrc file for credentials in combination with HTTP redirects. This flaw was discovered on December 30, 2024, and was publicly disclosed on February 5, 2025, with the release of curl 8.12.0 (Curl Advisory).

The vulnerability occurs when curl is configured to use a .netrc file for credentials and follows HTTP redirects. The specific condition requires the netrc file to have a 'default' entry that omits both login and password fields. In this scenario, if a transfer to nn.tld redirects to zz.tld, curl would incorrectly pass the password intended for the first host to the second, separate host. The vulnerability has been classified as CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, with a CVSS 3.1 base score of 3.4 (Low) (Curl Advisory, NVD).

The vulnerability could lead to the exposure of sensitive credentials to unauthorized hosts during HTTP redirects. While the impact is considered Low due to the specific circumstances required for exploitation, it could potentially expose user credentials to malicious redirect targets (Curl Advisory).

Three recommended actions have been provided to address this vulnerability: 1) Upgrade curl and libcurl to version 8.12.0 or later, 2) Apply the patch to your version and rebuild, or 3) Avoid using netrc together with redirects. The vulnerability was fixed in curl 8.12.0, released on February 5, 2025 (Curl Advisory).