Curl_input_negotiate: do not delegate GSSAPI credentials

This is a security flaw. See curl advisory 20110623 for details. Reported by: Richard Silverman
2025-01-30 14:22:33 +08:00 · 2011-06-08 00:10:26 +02:00 · 2011-06-08 00:10:26 +02:00 · 5c314c6bb4
commit 5c314c6bb4
parent 9016958aa8
1 changed files with 1 additions and 1 deletions
--- a/lib/http_negotiate.c
+++ b/lib/http_negotiate.c
@ -243,7 +243,7 @@ int Curl_input_negotiate(struct connectdata *conn, bool proxy,
                                      &neg_ctx->context,
                                      neg_ctx->server_name,
                                      GSS_C_NO_OID,
-                                      GSS_C_DELEG_FLAG,
+                                      0,
                                      0,
                                      GSS_C_NO_CHANNEL_BINDINGS,
                                      &input_token,