Public bug reported:
After the curl security update from USN-8932-1 (noble: curl 8.5.0-2ubuntu10.16,
libcurl3t64-gnutls 8.5.0-2ubuntu10.16), any `git clone` / `git fetch` over
HTTP(S) that carries credentials in the URL (http://user:password@host/repo)
and has no credential helper configured fails with:
Cloning into 'repo'...
warning: redirecting to http://host/org/repo/
fatal: could not read Username for 'http://host': No such device or address
The server performs no redirect. The failure is deterministic and breaks
non-interactive use (CI systems, mirroring, scripts), which is exactly where
credentials in the URL are common.
The same command succeeds on a host where libcurl3t64-gnutls is still at the
previous version. Downgrading libcurl3t64-gnutls fixes it; upgrading it again
breaks it.
[Root cause]
USN-8932-1 backports the fix for CVE-2026-94266
(https://curl.se/docs/CVE-2026-94266.html, upstream commit
https://github.com/curl/curl/commit/7a6bd027d0de, curl 8.23.0). After that fix
CURLINFO_EFFECTIVE_URL always returns the URL with the user and password
removed, regardless of where the credentials came from.
git's http.c (update_url_from_redirect) detects a redirect by comparing the URL
it requested with CURLINFO_EFFECTIVE_URL using a plain strcmp(). Since the
effective URL no longer contains "user:password@", git concludes it was
redirected, prints the misleading "redirecting to" warning (the URL it prints
is the requested URL with credentials stripped, hence the trailing slash),
re-initialises its credentials from the new base URL, which has none, gets a
401 and tries to prompt for a username. Without a terminal that is
"could not read Username ... No such device or address".
Upstream git fixed this on 2026-09-28 in commit 76524c2604
"http: handle curl stripping creds from effective url"
(https://github.com/git/git/commit/76524c2604). The fix adds
strip_url_credential() / match_effective_url() so the comparison is repeated
with the credentials removed from the requested URL. The patch is small and
confined to http.c.
The git package in noble (1:2.43.0-1ubuntu7.3) does not contain this fix, so
the curl SRU introduced an incompatibility between two packages shipped in the
same release.
[Steps to reproduce]
1. Ubuntu 24.04 with git 1:2.43.0-1ubuntu7.3 and
libcurl3t64-gnutls 8.5.0-2ubuntu10.16 (a plain ubuntu:24.04 container with
`apt-get install git` is enough).
2. Any git repository served over HTTP with basic auth (Gitea, GitLab,
git-http-backend behind nginx with auth_basic). No credential helper
configured.
3. Run non-interactively:
GIT_TRACE_CURL=1 GIT_TERMINAL_PROMPT=0 git clone
http://user:password@host/org/repo /tmp/repo
Actual result (trace filtered to the relevant lines):
http.c:804 => Send header: Authorization: Basic <redacted>
warning: redirecting to http://host/org/repo/
fatal: could not read Username for 'http://host': terminal prompts disabled
The trace contains no 3xx response and no Location header from the server,
and the second request is sent without an Authorization header.
Expected result: the clone succeeds, as it does with the previous
libcurl3t64-gnutls or with git built from current upstream master.
[Workaround]
- Pin libcurl to the previous version after downgrading:
apt-mark hold curl libcurl4t64 libcurl3t64-gnutls
This leaves the CVEs from USN-8932-1 unpatched.
- Configure a credential helper; git then recovers by asking the helper after
the false redirect.
[Proposed fix]
Backport git commit 76524c2604 to the noble git package (and to any other
release that received the CVE-2026-94266 curl fix), or revert the
CURLINFO_EFFECTIVE_URL change in the curl SRU until git is updated.
[Environment]
Ubuntu 24.04 LTS (amd64)
git 1:2.43.0-1ubuntu7.3
libcurl3t64-gnutls 8.5.0-2ubuntu10.16, curl 8.5.0-2ubuntu10.16
** Affects: curl (Ubuntu)
Importance: Undecided
Status: Confirmed
** Affects: git (Ubuntu)
Importance: Undecided
Status: Confirmed
** Tags: regression-update
** Also affects: curl (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2171054
Title:
git clone over HTTP with credentials in the URL fails after curl SRU
for CVE-2026-94266 (USN-8932-1): "could not read Username"
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/curl/+bug/2171054/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
