From 47e36cfbe1151972715b014a4f658b405b60d660 Mon Sep 17 00:00:00 2001 From: Daniel Stenberg Date: Wed, 10 Dec 2025 11:40:47 +0100 Subject: [PATCH] [PATCH] curl_sasl: if redirected, require permission to use bearer Closes #19933 Backported-by: Samuel Henrique * Refresh patch context for lib/curl_sasl.c Backported by: Samuel Henrique * Refresh line numbers for bookworm 7.88.1: same functions (Curl_sasl_start and Curl_sasl_continue), -7 line offset. Gbp-Pq: Name CVE-2025-14524.patch --- lib/curl_sasl.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/lib/curl_sasl.c b/lib/curl_sasl.c index 119fb9b2..2dd6b00b 100644 --- a/lib/curl_sasl.c +++ b/lib/curl_sasl.c @@ -349,7 +349,10 @@ CURLcode Curl_sasl_start(struct SASL *sasl, struct Curl_easy *data, data->set.str[STRING_SERVICE_NAME] : sasl->params->service; #endif - const char *oauth_bearer = data->set.str[STRING_BEARER]; + const char *oauth_bearer = + (!data->state.this_is_a_follow || data->set.allow_auth_to_other_hosts) ? + data->set.str[STRING_BEARER] : NULL; + struct bufref nullmsg; Curl_conn_get_host(data, FIRSTSOCKET, &hostname, &disp_hostname, &port); @@ -536,7 +539,10 @@ CURLcode Curl_sasl_continue(struct SASL *sasl, struct Curl_easy *data, data->set.str[STRING_SERVICE_NAME] : sasl->params->service; #endif - const char *oauth_bearer = data->set.str[STRING_BEARER]; + const char *oauth_bearer = + (!data->state.this_is_a_follow || data->set.allow_auth_to_other_hosts) ? + data->set.str[STRING_BEARER] : NULL; + struct bufref serverdata; Curl_conn_get_host(data, FIRSTSOCKET, &hostname, &disp_hostname, &port); -- 2.30.2