CVE-2017-7468
published 2018-07-16CVE-2017-7468: In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to resume a TLS session even if the client certificate had changed. That is…
PriorityP335high7.5CVSS 3.0
AVNACLPRNUINSUCNIHAN
EPSS
0.35%
57.8th percentile
In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which was established by the previous certificate (or no certificate). libcurl supports by default the use of TLS session id/ticket to resume previous TLS sessions to speed up subsequent TLS handshakes. They are used when for any reason an existing TLS connection couldn't be kept alive to make the next handshake faster. This flaw is a regression and identical to CVE-2016-5419 reported on August 3rd 2016, but affecting a different version range.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | macos_sierra_10.12.6_security_update_2017-003_el_capitan_and_security_update_201 | — | — |
| debian | curl | < curl 7.52.1-5 (bookworm) | curl 7.52.1-5 (bookworm) |
| haxx | curl | >= 0 < 7.52.1-5 | 7.52.1-5 |
| haxx | curl | >= 0 < 7.52.1-5 | 7.52.1-5 |
| haxx | curl | >= 0 < 7.52.1-5 | 7.52.1-5 |
| haxx | curl | >= 0 < 7.52.1-5 | 7.52.1-5 |
| haxx | libcurl | 7.52.0 – 7.53.1 | — |
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Apple
CVE-2017-7468: macOS Sierra 10.12.6, Security Update 2017-003 El Capitan, and Security Update 2017-003 Yosemite
vendor_apple·2017-07-19·CVSS 4.8
CVE-2017-7468 [MEDIUM] CVE-2017-7468: macOS Sierra 10.12.6, Security Update 2017-003 El Capitan, and Security Update 2017-003 Yosemite
Apple Security Update: About the security content of macOS Sierra 10.12.6, Security Update 2017-003 El Capitan, and Security Update 2017-003 Yosemite
Product: macOS Sierra 10.12.6, Security Update 2017-003 El Capitan, and Security Update 2017-003 Yosemite
CVE: CVE-2017-7468
Component: CVE-2017-7468
Ubuntu
curl vulnerability
vendor_ubuntu·2017-04-20
CVE-2017-7468 curl vulnerability
Title: curl vulnerability
Summary: Applications using curl could allow unintended access over the network.
It was discovered that curl incorrectly handled client certificates when
resuming a TLS session. A remote attacker could use this to hijack a
previously authenticated connection.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
curl: TLS session resumption client cert bypass
vendor_redhat·2017-04-19·CVSS 7.5
CVE-2017-7468 [HIGH] CWE-295 curl: TLS session resumption client cert bypass
curl: TLS session resumption client cert bypass
In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which was established by the previous certificate (or no certificate). libcurl supports by default the use of TLS session id/ticket to resume previous TLS sessions to speed up subsequent TLS handshakes. They are used when for any reason an existing TLS connection couldn't be kept alive to make the next handshake faster. This flaw is a regression and identical to CVE-2016-5419 reported on August 3rd 2016, but affecting a different version range.
Package: r
Debian
CVE-2017-7468: curl - In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to res...
vendor_debian·2017·CVSS 7.5
CVE-2017-7468 [HIGH] CVE-2017-7468: curl - In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to res...
In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which was established by the previous certificate (or no certificate). libcurl supports by default the use of TLS session id/ticket to resume previous TLS sessions to speed up subsequent TLS handshakes. They are used when for any reason an existing TLS connection couldn't be kept alive to make the next handshake faster. This flaw is a regression and identical to CVE-2016-5419 reported on August 3rd 2016, but affecting a different version range.
Scope: local
bookworm: resolved (fixed in 7.52.1-5)
bullseye
GHSA
GHSA-5v44-xcm9-r9jw: In curl and libcurl 7
ghsa_unreviewed·2022-05-13·CVSS 7.5
CVE-2017-7468 [HIGH] CWE-295 GHSA-5v44-xcm9-r9jw: In curl and libcurl 7
In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which was established by the previous certificate (or no certificate). libcurl supports by default the use of TLS session id/ticket to resume previous TLS sessions to speed up subsequent TLS handshakes. They are used when for any reason an existing TLS connection couldn't be kept alive to make the next handshake faster. This flaw is a regression and identical to CVE-2016-5419 reported on August 3rd 2016, but affecting a different version range.
OSV
CVE-2017-7468: In curl and libcurl 7
osv·2018-07-16·CVSS 7.5
CVE-2017-7468 [HIGH] CVE-2017-7468: In curl and libcurl 7
In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which was established by the previous certificate (or no certificate). libcurl supports by default the use of TLS session id/ticket to resume previous TLS sessions to speed up subsequent TLS handshakes. They are used when for any reason an existing TLS connection couldn't be kept alive to make the next handshake faster. This flaw is a regression and identical to CVE-2016-5419 reported on August 3rd 2016, but affecting a different version range.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2017-7468 mingw-curl: curl: TLS session resumption client cert bypass [fedora-all]
bugzilla·2017-04-19·CVSS 4.8
CVE-2017-7468 [MEDIUM] CVE-2017-7468 mingw-curl: curl: TLS session resumption client cert bypass [fedora-all]
CVE-2017-7468 mingw-curl: curl: TLS session resumption client cert bypass [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported
Bugzilla
CVE-2017-7468 curl: TLS session resumption client cert bypass
bugzilla·2017-04-19·CVSS 7.5
CVE-2017-7468 [HIGH] CVE-2017-7468 curl: TLS session resumption client cert bypass
CVE-2017-7468 curl: TLS session resumption client cert bypass
libcurl would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which was established by the previous certificate (or no certificate).
libcurl supports by default the use of TLS session id/ticket to resume previous TLS sessions to speed up subsequent TLS handshakes. They are used when for any reason an existing TLS connection couldn't be kept alive to make the next handshake faster.
This flaw is a regression and identical to CVE-2016-5419 reported on August 3rd 2016, but affecting a different version range.
External References:
https://curl.haxx.se/doc
Bugzilla
CVE-2017-7468 curl: TLS session resumption client cert bypass [fedora-all]
bugzilla·2017-04-19·CVSS 4.8
CVE-2017-7468 [MEDIUM] CVE-2017-7468 curl: TLS session resumption client cert bypass [fedora-all]
CVE-2017-7468 curl: TLS session resumption client cert bypass [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of
http://www.securityfocus.com/bid/97962http://www.securitytracker.com/id/1038341https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7468https://curl.haxx.se/docs/adv_20170419.htmlhttps://security.gentoo.org/glsa/201709-14http://www.securityfocus.com/bid/97962http://www.securitytracker.com/id/1038341https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7468https://curl.haxx.se/docs/adv_20170419.htmlhttps://security.gentoo.org/glsa/201709-14
2018-07-16
Published