commit 7d598b883eca2d63fa2df9e604a67b6c0c95c15a
Author: Daniel Stenberg <daniel@haxx.se>
Date:   Mon Apr 25 17:59:15 2022 +0200

    [Backport] openssl: don't leak the SRP credentials in redirects either
    
    Offering: RTOS
    CVE: CVE-2022-27774
    Reference: upstream_commit_id=139a54ed0a172adaaf1a78d6f4fff50b2c3f9e08
    
    DTS/AR: DTS2022042805098
    type: LTS
    reason: fix CVE-2022-27774 for curl.
    weblink：https://github.com/curl/curl/commit/139a54ed0a172adaaf1a78d6f4fff50b2c3f9e08
    
    Follow-up to 620ea21410030
    
    Reported-by: Harry Sintonen
    Closes #8751
    
    Signed-off-by: lvshengyuan <lvshengyuan1@h-partners.com>

diff --git a/lib/http.c b/lib/http.c
index 180edaf4b..c4427f15a 100644
--- a/lib/http.c
+++ b/lib/http.c
@@ -776,10 +776,10 @@ output_auth_headers(struct Curl_easy *data,
 }
 
 /*
- * allow_auth_to_host() tells if autentication, cookies or other "sensitive
- * data" can (still) be sent to this host.
+ * Curl_allow_auth_to_host() tells if authentication, cookies or other
+ * "sensitive data" can (still) be sent to this host.
  */
-static bool allow_auth_to_host(struct Curl_easy *data)
+bool Curl_allow_auth_to_host(struct Curl_easy *data)
 {
   struct connectdata *conn = data->conn;
   return (!data->state.this_is_a_follow ||
@@ -864,7 +864,7 @@ Curl_http_output_auth(struct Curl_easy *data,
 
   /* To prevent the user+password to get sent to other than the original host
      due to a location-follow */
-  if(allow_auth_to_host(data)
+  if(Curl_allow_auth_to_host(data)
 #ifndef CURL_DISABLE_NETRC
      || conn->bits.netrc
 #endif
@@ -1925,7 +1925,7 @@ CURLcode Curl_add_custom_headers(struct Curl_easy *data,
                    checkprefix("Cookie:", compare)) &&
                   /* be careful of sending this potentially sensitive header to
                      other hosts */
-                  !allow_auth_to_host(data))
+                  !Curl_allow_auth_to_host(data))
             ;
           else {
 #ifdef USE_HYPER
diff --git a/lib/http.h b/lib/http.h
index bce171550..76741c5b0 100644
--- a/lib/http.h
+++ b/lib/http.h
@@ -317,4 +317,10 @@ Curl_http_output_auth(struct Curl_easy *data,
                       bool proxytunnel); /* TRUE if this is the request setting
                                             up the proxy tunnel */
 
+/*
+ * Curl_allow_auth_to_host() tells if authentication, cookies or other
+ * "sensitive data" can (still) be sent to this host.
+ */
+bool Curl_allow_auth_to_host(struct Curl_easy *data);
+
 #endif /* HEADER_CURL_HTTP_H */
diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
index 8af23b783..2eae2a8ef 100644
--- a/lib/vtls/openssl.c
+++ b/lib/vtls/openssl.c
@@ -2866,7 +2866,8 @@ static CURLcode ossl_connect_step1(struct Curl_easy *data,
 #endif
 
 #ifdef USE_OPENSSL_SRP
-  if(ssl_authtype == CURL_TLSAUTH_SRP) {
+  if((ssl_authtype == CURL_TLSAUTH_SRP) &&
+     Curl_allow_auth_to_host(data)) {
     char * const ssl_username = SSL_SET_OPTION(username);
 
     infof(data, "Using TLS-SRP username: %s", ssl_username);