TLS Session Resumption Bypass Vulnerability in curl: CVE-2016-5419
Summary
ALPINE-CVE-2016-5419: curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, which allows remote attackers to bypass intended restrictions by resuming a session. Affects curl versions < 7.50.1-r0. Fixed in 7.50.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
curl is a widely used command-line tool and library for transferring data with URLs. It supports various protocols including HTTP, HTTPS, FTP, and more. curl is known for its versatility and is commonly utilized in scripts and applications for data transfer. The vulnerability identified as CVE-2016-5419 affects curl versions prior to 7.50.1, where it fails to prevent TLS session resumption when the client certificate has changed, potentially allowing attackers to bypass intended security restrictions.
Vulnerability Detail
The vulnerability arises from the way curl and libcurl handle TLS session resumption. When a client certificate is changed, the system does not properly invalidate the previous session, allowing an attacker to resume a session with the old certificate. This can lead to unauthorized access and data leakage, as the attacker can exploit this flaw to bypass security measures that rely on client authentication. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
7.50.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using TLS session resumption or ensure that client certificates are not changed during active sessions. This can be done by configuring the application to disable session resumption or by managing client certificates carefully.
Conclusion
CVE-2016-5419 is a significant vulnerability in curl that can lead to serious security breaches if not addressed. Users are strongly encouraged to update to the latest patched versions of curl to mitigate the risk. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for curl →
FAQ
CVE-2016-5419 is a vulnerability in curl that allows attackers to bypass security restrictions by resuming a TLS session even after the client certificate has changed.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Check your application against this vulnerability using the Vulert playground without needing to sign up.
If exploited, this vulnerability can lead to unauthorized access to sensitive data and systems, as attackers can bypass client authentication.
The CVSS score for CVE-2016-5419 is 7.5, indicating a high severity level.
You can update curl using the command: apk add --update curl=7.50.1-r0 for affected Alpine versions.
References
Related vulnerabilities
Recent vulnerabilities recorded for curl.
