TLS Certificate Status Request Extension Feature Misleading in curl
Summary
CVE-2017-2629: curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate's validity in the code that checks for a test success or failure. Affects curl across 2 version ranges.
< 7.53.0-r0
< a7135ac3c3d825ec9f4919ee0212434e01e76b4c
Fixed in 7.53.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The curl package is a widely used command-line tool and library for transferring data with URLs. It supports various protocols, including HTTP, HTTPS, FTP, and more. The package is commonly used in web applications and other software that require network communication. However, a vulnerability has been discovered in versions before 7.53.0 that affects the TLS Certificate Status Request extension feature.
Vulnerability Detail
The TLS Certificate Status Request extension feature in curl is designed to check for a fresh proof of the server's certificate's validity. However, due to an incorrect implementation, the feature always thinks there is valid proof, even when there is none or if the server doesn't support the TLS extension. This flaw can mislead users into thinking that a server's certificate is valid when it's actually invalid or not supported. This vulnerability can lead to security risks, as users may not detect when a server's certificate becomes invalid.
How To Fix
Minimum fixed version
7.53.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of the curl package to ensure the proper validation of server certificates.
Conclusion
The TLS Certificate Status Request extension feature in curl versions before 7.53.0 has an incorrect implementation that can mislead users about the validity of a server's certificate. To mitigate this vulnerability, it is crucial to update the curl package to version 7.53.0 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for curl →
FAQ
Curl is a command-line tool and library for transferring data with URLs. It supports various protocols and is commonly used in web applications and other software that require network communication.
The TLS Certificate Status Request extension feature is a mechanism that allows clients to request a fresh proof of a server's certificate's validity. It helps ensure that the server's certificate is still valid and has not been revoked.
This vulnerability affects versions of curl before 7.53.0. It causes the TLS Certificate Status Request extension feature to always think there is valid proof of the server's certificate's validity, even when there is none or if the server doesn't support the TLS extension. This can mislead users into thinking that a server's certificate is valid when it's actually invalid or not supported.
The potential risks of this vulnerability include users not detecting when a server's certificate becomes invalid or being misled into thinking that a server is in a better shape than it actually is. This can lead to security risks and potential exploitation of the server.
To fix this vulnerability, it is recommended to update the curl package to version 7.53.0 or later. This update includes a fix for the incorrect TLS Certificate Status Request extension feature. Users can download the latest version of curl from the official website or use package managers to update the package.
References
Related vulnerabilities
Recent vulnerabilities recorded for curl.
