PT-2017-17755 · Curl+2 · Libcurl+3

Lijian996 · Publicado 2017-04-19 · Atualizado 2026-05-18 · CVE-2017-7468

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions curl and libcurl versions 7.52.0 through 7.53.1

Description The issue arises from libcurl attempting to resume a TLS session even when the client certificate has changed. This is problematic because a server may skip the client certificate check on resume and use the old identity established by the previous certificate. libcurl uses TLS session id/ticket by default to resume previous TLS sessions, which can lead to this flaw. This is a regression issue similar to one previously reported.

Recommendations For versions 7.52.0 through 7.53.1, update to a version outside of this range to resolve the issue. As a temporary workaround, consider disabling the use of TLS session id/ticket to prevent the resumption of TLS sessions with changed client certificates.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-305

CWE-295

Identificadores relacionados

ALT-PU-2017-1492

CLEANSTART-2026-AY18527

CLEANSTART-2026-BW46578

CLEANSTART-2026-DI23929

CLEANSTART-2026-LQ42192

CLEANSTART-2026-OF85770

CVE-2017-7468

OPENSUSE-SU-2024:10582-1

Produtos afetados

Alt Linux

Ubuntu

Curl

Libcurl

Referências · 317

• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-BW46578.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-OF85770.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-LQ42192.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-AY18527.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-DI23929.json · Nota
• https://osv.dev/vulnerability/CVE-2024-6197 · Nota
• https://osv.dev/vulnerability/CVE-2023-38039 · Nota
• https://osv.dev/vulnerability/CVE-2018-1000301 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-28321 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2022-27779 · Nota de Segurança
• https://suse.com/security/cve/CVE-2018-16842 · Nota
• https://suse.com/security/cve/CVE-2016-9586 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2024-7264 · Nota de Segurança
• https://suse.com/security/cve/CVE-2017-1000099 · Nota
• https://osv.dev/vulnerability/CVE-2019-5436 · Nota