Commit 5c314c6b authored by Daniel Stenberg's avatar Daniel Stenberg
Browse files

Curl_input_negotiate: do not delegate GSSAPI credentials 

This is a security flaw. See curl advisory 20110623 for details.

Reported by: Richard Silverman
parent 9016958a

lib/http_negotiate.c

+1 −1
Original line number Diff line number Diff line
@@ -243,7 +243,7 @@ int Curl_input_negotiate(struct connectdata *conn, bool proxy, 
                                      &neg_ctx->context,

                                      neg_ctx->server_name,

                                      GSS_C_NO_OID,

                                      GSS_C_DELEG_FLAG,

                                      0,

                                      0,

                                      GSS_C_NO_CHANNEL_BINDINGS,

                                      &input_token,