description: When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.
problem types: Business Logic Errors (CWE-840)
affected:
{
vendor: n/a
product: https://github.com/curl/curl
versions:
version: Fixed in 7.84.0, status: affected
}