Red Hat Security AdvisoryRHSA-2016:2575
curl security, bug fix, and enhancement update
Released 2016-11-03 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) curl-7.29.0-35.el7, libcurl-7.29.0-35.el7
- Red Hat Enterprise Linux Client Optional (v. 7) libcurl-devel-7.29.0-35.el7
- Red Hat Enterprise Linux ComputeNode (v. 7) curl-7.29.0-35.el7, libcurl-7.29.0-35.el7
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) libcurl-devel-7.29.0-35.el7
- Red Hat Enterprise Linux Server (v. 7) curl-7.29.0-35.el7, libcurl-7.29.0-35.el7, libcurl-7.29.0-35.el7.ppc +2
- Red Hat Enterprise Linux Workstation (v. 7) curl-7.29.0-35.el7, libcurl-7.29.0-35.el7, libcurl-devel-7.29.0-35.el7
Fixes 3 records
Priority MEDIUM 49
curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attackers to hijack the authentication of the connection by leveraging a previously c…
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.15362 · Published 2016-08-10 · Partial fix CWE-285
Priority MEDIUM 49
curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, which allows remote attackers to bypass intended restrictions by resuming a session.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.15063 · Published 2016-08-10 · Partial fix CWE-310
Priority MEDIUM 44
curl and libcurl before 7.50.2, when built with NSS and the libnsspem.so library is available at runtime, allow remote attackers to hijack the authentication of a TLS connection by leveraging reuse of a previously loaded…
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.0818 · Published 2016-10-03 · Partial fix CWE-287
THREATIST.IORead the docs