Insecure digital certificates In curl
Description
curl and libcurl before 7.50.2, when built with NSS and the libnsspem.so library is available at runtime, allow remote attackers to hijack the authentication of a TLS connection by leveraging reuse of a previously loaded client certificate from file for a connection for which no certificate has been set, a different vulnerability than CVE-2016-5420.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 alpine v3.8 | 7.50.2 | ||
 debian 14 | 7.51.0-1 | ||
alpine v3.15 | 7.50.2-r0 | ||
alpine v3.16 | 7.50.2-r0 | ||
alpine v3.17 | 7.50.2-r0 | ||
alpine v3.20 | 7.50.2-r0 | ||
alpine v3.21 | 7.50.2-r0 | ||
alpine v3.4 | 7.50.2-r0 | ||
alpine v3.10 | 7.50.2-r0 | ||
alpine v3.11 | 7.50.2 |
1-10 of 28
10
Aliases
1. 2. 3. 4. 5. 6. 7.