Bug 2446475
| Summary: | CVE-2026-3783 rust: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect [fedora-42] | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Vipul Nair <vinair> |
| Component: | rust | Assignee: | Josh Stone <jistone> |
| Status: | CLOSED NOTABUG | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 42 | CC: | amulhern, igor.raits, jchecahi, jistone, paumurph, rust-sig |
| Target Milestone: | --- | Keywords: | Security, SecurityTracking |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | {"flaws": ["db5eec15-4e34-401b-8310-3c003d3cd346"]} | ||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2026-03-11 16:30:11 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 2446450 | ||
|
Description
Vipul Nair
2026-03-11 12:08:47 UTC
We use the Rust "curl" crate to dynamically link to the system libcurl.so, so there's nothing for us to address on our own. We also ensure this is the case by removing the vendor/curl-sys*/curl/ source code during %prep. The curl package only needs to fix the CVE itself. |