CVE-2017-7468 Security feature bypass in curl
libcurl allows TLS session resumption with changed client certificates, potentially bypassing server-side identity verification checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-7468?
CVE-2017-7468 is a medium-severity vulnerability in Haxx Libcurl, published on 16 Jul 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which was established by the previous certificate (or no certificate). libcurl supports by default the use of TLS session id/ticket to resume previous TLS sessions to speed up subsequent TLS handshakes. They are used when for any reason an existing TLS connection couldn't be kept alive to make the next handshake faster. This flaw is a regression and identical to CVE-2016-5419 reported on August 3rd 2016, but affecting a different version range.
Weakness: CWE-295
Which versions are affected by CVE-2017-7468?
It affects 1 product.
Products include Haxx Libcurl.
How do I fix CVE-2017-7468?
Upgrade to a fixed version.
Is CVE-2017-7468 being exploited?
There is no known exploitation of CVE-2017-7468 in the wild and no public exploit code.
Other vulnerabilities in Haxx Libcurl
Sources
Also known as ALPINE-CVE-2017-7468, CLEANSTART-2026-JA19177, CURL-CVE-2017-7468, DEBIAN-CVE-2017-7468, GHSA-5v44-xcm9-r9jw.