CVE-2016-5419
published 2016-08-10CVE-2016-5419: curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, which allows remote attackers to bypass intended…
PriorityP353high7.5CVSS 3.0
AVNACLPRNUINSUCHINAN
EPSS
15.06%
96.3th percentile
curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, which allows remote attackers to bypass intended restrictions by resuming a session.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | macos_sierra_10.12.2_security_update_2016-003_el_capitan_and_security_update_201 | — | — |
| debian | curl | < curl 7.50.1-1 (bookworm) | curl 7.50.1-1 (bookworm) |
| debian | curl | < curl 7.52.1-5 (bookworm) | curl 7.52.1-5 (bookworm) |
| debian | debian_linux | — | — |
| android | — | — | |
| haxx | curl | >= 0 < 7.50.1-1 | 7.50.1-1 |
| haxx | curl | >= 0 < 7.52.1-5 | 7.52.1-5 |
| haxx | curl | >= 0 < 7.50.1-1 | 7.50.1-1 |
| haxx | curl | >= 0 < 7.52.1-5 | 7.52.1-5 |
| haxx | curl | >= 0 < 7.50.1-1 | 7.50.1-1 |
| haxx | curl | >= 0 < 7.52.1-5 | 7.52.1-5 |
| haxx | curl | >= 0 < 7.50.1-1 | 7.50.1-1 |
| haxx | curl | >= 0 < 7.52.1-5 | 7.52.1-5 |
| haxx | curl | >= 0 < 7.35.0-1ubuntu2.8 | 7.35.0-1ubuntu2.8 |
| haxx | curl | >= 0 < 7.47.0-1ubuntu2.1 | 7.47.0-1ubuntu2.1 |
| haxx | libcurl | <= 7.50.0 | — |
| haxx | libcurl | 7.52.0 – 7.53.1 | — |
| opensuse | leap | — | — |
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
curl: TLS session resumption client cert bypass
vendor_redhat·2017-04-19·CVSS 7.5
CVE-2017-7468 [HIGH] CWE-295 curl: TLS session resumption client cert bypass
curl: TLS session resumption client cert bypass
In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which was established by the previous certificate (or no certificate). libcurl supports by default the use of TLS session id/ticket to resume previous TLS sessions to speed up subsequent TLS handshakes. They are used when for any reason an existing TLS connection couldn't be kept alive to make the next handshake faster. This flaw is a regression and identical to CVE-2016-5419 reported on August 3rd 2016, but affecting a different version range.
Package: r
Debian
CVE-2017-7468: curl - In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to res...
vendor_debian·2017·CVSS 7.5
CVE-2017-7468 [HIGH] CVE-2017-7468: curl - In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to res...
In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which was established by the previous certificate (or no certificate). libcurl supports by default the use of TLS session id/ticket to resume previous TLS sessions to speed up subsequent TLS handshakes. They are used when for any reason an existing TLS connection couldn't be kept alive to make the next handshake faster. This flaw is a regression and identical to CVE-2016-5419 reported on August 3rd 2016, but affecting a different version range.
Scope: local
bookworm: resolved (fixed in 7.52.1-5)
bullseye
Apple
CVE-2016-5419: macOS Sierra 10.12.2, Security Update 2016-003 El Capitan, and Security Update 2016-007 Yosemite
vendor_apple·2016-12-13·CVSS 7.5
CVE-2016-5419 [HIGH] CVE-2016-5419: macOS Sierra 10.12.2, Security Update 2016-003 El Capitan, and Security Update 2016-007 Yosemite
Apple Security Update: About the security content of macOS Sierra 10.12.2, Security Update 2016-003 El Capitan, and Security Update 2016-007 Yosemite
Product: macOS Sierra 10.12.2, Security Update 2016-003 El Capitan, and Security Update 2016-007 Yosemite
CVE: CVE-2016-5419
Component: CVE-2016-5419
Android
CVE-2016-5419: Android Security Bulletin 2016-12-01
CVE: CVE-2016-5419
Severity: HIGH
Affected AOSP versions: 7
vendor_android·2016-12-01·CVSS 7.5
CVE-2016-5419 [HIGH] CVE-2016-5419: Android Security Bulletin 2016-12-01
CVE: CVE-2016-5419
Severity: HIGH
Affected AOSP versions: 7
Android Security Bulletin 2016-12-01
CVE: CVE-2016-5419
Severity: HIGH
Affected AOSP versions: 7.0
References: A-31271247
Ubuntu
curl vulnerabilities
vendor_ubuntu·2016-08-08·CVSS 7.5
CVE-2016-5419 [HIGH] curl vulnerabilities
Title: curl vulnerabilities
Summary: Several security issues were fixed in curl.
Bru Rom discovered that curl incorrectly handled client certificates when
resuming a TLS session. (CVE-2016-5419)
It was discovered that curl incorrectly handled client certificates when
reusing TLS connections. (CVE-2016-5420)
Marcelo Echeverria and Fernando Muñoz discovered that curl incorrectly
reused a connection struct, contrary to expectations. This issue only
applied to Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-5421)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
curl: TLS session resumption client cert bypass
vendor_redhat·2016-08-03·CVSS 7.5
CVE-2016-5419 [HIGH] CWE-295 curl: TLS session resumption client cert bypass
curl: TLS session resumption client cert bypass
curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, which allows remote attackers to bypass intended restrictions by resuming a session.
It was found that the libcurl library did not prevent TLS session resumption when the client certificate had changed. An attacker could potentially use this flaw to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate.
Package: rh-dotnetcore10-curl (.NET Core 1.0 on Red Hat Enterprise Linux) - Out of support scope
Package: rh-dotnetcore11-curl (.NET Core 1.1 on Red Hat Enterprise Linux) - Out of support scope
Package: rh-dotnet20-curl (.NET Core 2.0 on Red Hat Enterprise Lin
Debian
CVE-2016-5419: curl - curl and libcurl before 7.50.1 do not prevent TLS session resumption when the cl...
vendor_debian·2016·CVSS 7.5
CVE-2016-5419 [HIGH] CVE-2016-5419: curl - curl and libcurl before 7.50.1 do not prevent TLS session resumption when the cl...
curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, which allows remote attackers to bypass intended restrictions by resuming a session.
Scope: local
bookworm: resolved (fixed in 7.50.1-1)
bullseye: resolved (fixed in 7.50.1-1)
forky: resolved (fixed in 7.50.1-1)
sid: resolved (fixed in 7.50.1-1)
trixie: resolved (fixed in 7.50.1-1)
GHSA
GHSA-j5mq-cppw-g9w7: curl and libcurl before 7
ghsa_unreviewed·2022-05-14
CVE-2016-5419 [HIGH] GHSA-j5mq-cppw-g9w7: curl and libcurl before 7
curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, which allows remote attackers to bypass intended restrictions by resuming a session.
GHSA
GHSA-5v44-xcm9-r9jw: In curl and libcurl 7
ghsa_unreviewed·2022-05-13·CVSS 7.5
CVE-2017-7468 [HIGH] CWE-295 GHSA-5v44-xcm9-r9jw: In curl and libcurl 7
In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which was established by the previous certificate (or no certificate). libcurl supports by default the use of TLS session id/ticket to resume previous TLS sessions to speed up subsequent TLS handshakes. They are used when for any reason an existing TLS connection couldn't be kept alive to make the next handshake faster. This flaw is a regression and identical to CVE-2016-5419 reported on August 3rd 2016, but affecting a different version range.
OSV
CVE-2017-7468: In curl and libcurl 7
osv·2018-07-16·CVSS 7.5
CVE-2017-7468 [HIGH] CVE-2017-7468: In curl and libcurl 7
In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which was established by the previous certificate (or no certificate). libcurl supports by default the use of TLS session id/ticket to resume previous TLS sessions to speed up subsequent TLS handshakes. They are used when for any reason an existing TLS connection couldn't be kept alive to make the next handshake faster. This flaw is a regression and identical to CVE-2016-5419 reported on August 3rd 2016, but affecting a different version range.
OSV
CVE-2016-5419: curl and libcurl before 7
osv·2016-08-10·CVSS 7.5
CVE-2016-5419 [HIGH] CVE-2016-5419: curl and libcurl before 7
curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, which allows remote attackers to bypass intended restrictions by resuming a session.
OSV
curl vulnerabilities
osv·2016-08-08·CVSS 7.5
CVE-2016-5419 [HIGH] curl vulnerabilities
curl vulnerabilities
Bru Rom discovered that curl incorrectly handled client certificates when
resuming a TLS session. (CVE-2016-5419)
It was discovered that curl incorrectly handled client certificates when
reusing TLS connections. (CVE-2016-5420)
Marcelo Echeverria and Fernando Muñoz discovered that curl incorrectly
reused a connection struct, contrary to expectations. This issue only
applied to Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-5421)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2017-7468 curl: TLS session resumption client cert bypass
bugzilla·2017-04-19·CVSS 7.5
CVE-2017-7468 [HIGH] CVE-2017-7468 curl: TLS session resumption client cert bypass
CVE-2017-7468 curl: TLS session resumption client cert bypass
libcurl would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which was established by the previous certificate (or no certificate).
libcurl supports by default the use of TLS session id/ticket to resume previous TLS sessions to speed up subsequent TLS handshakes. They are used when for any reason an existing TLS connection couldn't be kept alive to make the next handshake faster.
This flaw is a regression and identical to CVE-2016-5419 reported on August 3rd 2016, but affecting a different version range.
External References:
https://curl.haxx.se/doc
Bugzilla
CVE-2016-5419 CVE-2016-5420 CVE-2016-5421 mingw-curl: various flaws [epel-7]
bugzilla·2016-08-03·CVSS 7.5
CVE-2016-5419 [HIGH] CVE-2016-5419 CVE-2016-5420 CVE-2016-5421 mingw-curl: various flaws [epel-7]
CVE-2016-5419 CVE-2016-5420 CVE-2016-5421 mingw-curl: various flaws [epel-7]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora EPEL.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
[bug automatically created by: add-tracking-bugs]
Bugzilla
CVE-2016-5419 CVE-2016-5420 CVE-2016-5421 curl: various flaws [fedora-all]
bugzilla·2016-08-03·CVSS 7.5
CVE-2016-5419 [HIGH] CVE-2016-5419 CVE-2016-5420 CVE-2016-5421 curl: various flaws [fedora-all]
CVE-2016-5419 CVE-2016-5420 CVE-2016-5421 curl: various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fed
Bugzilla
CVE-2016-5419 CVE-2016-5420 CVE-2016-5421 mingw-curl: various flaws [fedora-all]
bugzilla·2016-08-03·CVSS 7.5
CVE-2016-5419 [HIGH] CVE-2016-5419 CVE-2016-5420 CVE-2016-5421 mingw-curl: various flaws [fedora-all]
CVE-2016-5419 CVE-2016-5420 CVE-2016-5421 mingw-curl: various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions
Bugzilla
CVE-2016-5419 curl: TLS session resumption client cert bypass
bugzilla·2016-08-01·CVSS 7.5
CVE-2016-5419 [HIGH] CVE-2016-5419 curl: TLS session resumption client cert bypass
CVE-2016-5419 curl: TLS session resumption client cert bypass
It was reported that libcurl would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which was established by the previous certificate (or no certificate).
libcurl supports by default the use of TLS session id/ticket to resume previous TLS sessions to speed up subsequent TLS handshakes. They are used when for any reason an existing TLS connection couldn't be kept alive to make the next handshake faster.
External Reference:
https://curl.haxx.se/docs/adv_20160803A.html
Discussion:
Created curl tracking bugs for this issue:
Affects: fedora-all [bug 1363
http://lists.opensuse.org/opensuse-updates/2016-09/msg00011.htmlhttp://lists.opensuse.org/opensuse-updates/2016-09/msg00094.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2575.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2957.htmlhttp://www.debian.org/security/2016/dsa-3638http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlhttp://www.securityfocus.com/bid/92292http://www.securityfocus.com/bid/92319http://www.securitytracker.com/id/1036538http://www.securitytracker.com/id/1038341http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.563059http://www.ubuntu.com/usn/USN-3048-1https://access.redhat.com/errata/RHSA-2018:3558https://curl.haxx.se/docs/adv_20160803A.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GLPXQQKURBQFM4XM6645VRPTOE2AWG33/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3GQH4V3XAQ5Z53AMQRDEC3C3UHTW7QR/https://security.gentoo.org/glsa/201701-47https://source.android.com/security/bulletin/2016-12-01.htmlhttps://www.tenable.com/security/tns-2016-18http://lists.opensuse.org/opensuse-updates/2016-09/msg00011.htmlhttp://lists.opensuse.org/opensuse-updates/2016-09/msg00094.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2575.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2957.htmlhttp://www.debian.org/security/2016/dsa-3638http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlhttp://www.securityfocus.com/bid/92292http://www.securityfocus.com/bid/92319http://www.securitytracker.com/id/1036538http://www.securitytracker.com/id/1038341http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.563059http://www.ubuntu.com/usn/USN-3048-1https://access.redhat.com/errata/RHSA-2018:3558https://curl.haxx.se/docs/adv_20160803A.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GLPXQQKURBQFM4XM6645VRPTOE2AWG33/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3GQH4V3XAQ5Z53AMQRDEC3C3UHTW7QR/https://security.gentoo.org/glsa/201701-47https://source.android.com/security/bulletin/2016-12-01.htmlhttps://www.tenable.com/security/tns-2016-18
2016-08-10
Published