CVE-2016-7141 Auth bypass in n/a
Remote attackers can hijack TLS authentication by reusing a previously loaded client certificate when no certificate is set, affecting curl built with NSS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-7141?
CVE-2016-7141 is a high-severity authentication bypass vulnerability in Haxx Libcurl, published on 3 Oct 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
curl and libcurl before 7.50.2, when built with NSS and the libnsspem.so library is available at runtime, allow remote attackers to hijack the authentication of a TLS connection by leveraging reuse of a previously loaded client certificate from file for a connection for which no certificate has been set, a different vulnerability than CVE-2016-5420.
Weakness: CWE-287
Which versions are affected by CVE-2016-7141?
It affects 2 products.
Products include Haxx Libcurl, Opensuse Leap.
How do I fix CVE-2016-7141?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2016-7141 being exploited?
There is no known exploitation of CVE-2016-7141 in the wild and no public exploit code.
Other vulnerabilities in Haxx Libcurl
Sources
Also known as ALPINE-CVE-2016-7141, CLEANSTART-2026-RA92052, CURL-CVE-2016-7141, DEBIAN-CVE-2016-7141, DLA-616-1, GHSA-vx32-35rm-8jq5 and 1 more.