Cookie exposure due to unexpected file permission change

How it was found

Summary:

libcurl since 7.72.0 changes file specified in CURLOPT_COOKIEJAR to group and world readable, regardless of prior file permissions of an already existing file (assuming typical default umask of 022). This is unexpected as typically file permissions of an already existing file are not changed. Indeed, libcurl prior to this version keeps the original file permissions, as expected.

Steps To Reproduce:

1. install -m 600 /dev/null cookie.jar
2. ls -l cookie.jar
3. curl -s -c cookie.jar https://www.google.com -o /dev/null
4. ls -l cookie.jar

Supporting Material/References:

• This bug was introduced as a side effect of https://github.com/curl/curl/commit/b834890a3fa3f525cd8ef4e99554cdb4558d7e1b

Impact

Leak of confidential information stored in the CURLOPT_COOKIEJAR (libcurl) or -c / --cookie-jar (curl command line tool) file.