TLS Session Resumption Vulnerability in curl
Summary
CVE-2017-7468: In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to resume a TLS session even if the client certificate had changed. Affects curl across 2 version ranges.
< 7.54.0-r0
>= 95c717bbd9c327c38b4efcc37d5cda29b8ee2a36, <= 25df50aa3392ecdbf2b8256b93b30558e8b3a810
Fixed in 7.54.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
curl is a widely used command-line tool and library for transferring data with URLs. It supports various protocols, including HTTP, HTTPS, FTP, and more. The vulnerability in curl allows for the resumption of a TLS session even if the client certificate has changed. This can lead to a security issue where a server may use the old identity established by the previous certificate or no certificate at all. The vulnerability affects versions 7.52.0 to 7.53.1 of curl.
Vulnerability Detail
The vulnerability in curl arises from the improper handling of TLS session resumption. By default, curl uses TLS session id/ticket to resume previous TLS sessions, which helps speed up subsequent handshakes. However, in this case, even if the client certificate has changed, curl attempts to resume the session. This behavior is unacceptable as it allows a server to skip the client certificate check on resume and potentially use the old identity. The vulnerability was first reported as CVE-2016-5419 and is a regression in versions 7.52.0 to 7.53.1.
How To Fix
Minimum fixed version
7.54.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The TLS session resumption vulnerability in curl can lead to a server using an old client identity or no client certificate at all. It is recommended to update curl to version 7.54.0-r0 or later to fix this issue. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for curl →
FAQ
curl is a command-line tool and library for transferring data with URLs. It supports various protocols, including HTTP, HTTPS, FTP, and more.
TLS session resumption is a feature that allows for the reuse of a previously established TLS session to speed up subsequent handshakes.
The vulnerability in curl can lead to a security issue where a server may use the old identity established by the previous client certificate or no certificate at all.
To fix the vulnerability, update curl to version 7.54.0-r0 or later.
No specific workaround has been mentioned for this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for curl.
