CVE-2025-0167: netrc and default credential leak

How it was found

Summary:

The fix for CVE-2024-11053 seems to be incomplete.The information leak problem could be reproduced again if use netrc in step1.

Affected version

all

Steps To Reproduce:

1. Adapt test479 to use netrc like below(both of user and password are not provided for b.com):

machine a.com login alice password alicespassword

default

2.Run test479 3. The test would fail because alice and alicepassword were used for b.com.

I used the latest version curl 8.11.1 but the problem still exists.I'm not sure if this is expected.Please point it out if i'm wrong.

Impact

Summary:

Sensitive information disclosure.