ALPINE-CVE-2016-5419 PUBLISHED CVSS 7.5 HIGH

curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, which allows remote attackers to bypass intended restrictions by resuming a session.

Risk Scores

CVSS v3.0
7.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected Products

VendorProductVersions
Alpine:v3.3curl7.35.0-r0, 0, 7.19.2-r0
Alpine:v3.4curl7.19.4-r0, 0, 7.19.2-r0
Alpine:v3.6curl7.34.0-r1, 0, 7.19.2-r0
Alpine:v3.5curl7.44.0-r0, 7.47.1-r0, 7.41.0-r0
Alpine:v3.13curl7.19.4-r0, 7.19.2-r1, 7.19.2-r0
Alpine:v3.15curl7.48.0-r0, 0, 7.19.2-r0
Alpine:v3.11curl7.49.1-r0, 7.49.0-r0, 7.48.0-r0
Alpine:v3.22curl7.19.2-r0, 0, 7.19.2-r0
Alpine:v3.7curl7.28.0-r0, 7.20.1-r0, 7.19.7-r1
Alpine:v3.9curl7.45.0-r1, 7.19.7-r0, 7.19.6-r0
Alpine:v3.12curl0, 7.19.2-r0, 7.19.2-r1
Alpine:v3.18curl7.19.2-r1, 7.19.4-r0, 7.19.5-r0
Alpine:v3.10curl7.43.0-r0, 0, 7.19.2-r0
Alpine:v3.2curl7.36.0-r0, 0, 7.19.2-r0
Alpine:v3.19curl7.20.1-r0, 7.19.2-r0, 7.19.2-r1
Alpine:v3.21curl0, 7.19.5-r0, 7.34.0-r1
Alpine:v3.20curl0, 7.19.2-r0, 7.19.2-r1
Alpine:v3.23curl7.19.2-r1, 7.19.4-r0, 7.19.5-r0
Alpine:v3.16curl7.19.6-r0, 7.47.0-r0, 7.26.0-r0
Alpine:v3.14curl7.34.0-r1, 0, 7.19.2-r0

…and 2 more

Timeline

References

Open in Interactive Console →