An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocols: SMPTP(S), IMAP(S), POP3(S) and LDAP(S) (openldap only).
{
"unresolved_ranges": [
{
"source": "CPE_FIELD",
"extracted_events": [
{
"introduced": "8.2.0"
},
{
"fixed": "8.2.12"
},
{
"introduced": "9.0.0"
},
{
"fixed": "9.0.6"
}
],
"cpe": "cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*"
},
{
"source": "CPE_FIELD",
"cpe": "cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "9.1.0"
}
]
},
{
"source": "CPE_FIELD",
"cpe": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "10.0"
}
]
},
{
"source": "CPE_FIELD",
"cpe": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "11.0"
}
]
}
]
}