ALPINE-CVE-2017-2629 — Vulnetix

Try Vulnetix Request Demo

ALPINE-CVE-2017-2629 PUBLISHED CVSS 6.5 MEDIUM

curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate's validity in the code that checks for a test success or failure. It ends up always thinking there's valid proof, even when there is none or if the server doesn't support the TLS extension in question. This could lead to users not detecting when a server's certificate goes invalid or otherwise be mislead that the server is in a better shape than it is in reality. This flaw also exists in the command line tool (--cert-status).

Risk Scores

CVSS v3.0

6.5

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Affected Products

Vendor	Product	Versions
Alpine:v3.11	curl	7.52.1-r1, 0, 7.19.2-r0
Alpine:v3.22	curl	0, 7.19.2-r0, 7.19.4-r0
Alpine:v3.13	curl	7.52.1-r1, 0, 7.19.2-r0
Alpine:v3.20	curl	0, 7.19.2-r0, 7.19.4-r0
Alpine:v3.12	curl	7.21.4-r0, 0, 7.19.2-r0
Alpine:v3.4	curl	7.27.0-r1, 7.52.1-r0, 7.51.0-r0
Alpine:v3.16	curl	7.19.5-r0, 7.45.0-r0, 7.37.0-r0
Alpine:v3.2	curl	7.19.2-r0, 0, 7.52.1-r0
Alpine:v3.3	curl	7.40.0-r0, 7.39.0-r0, 7.38.0-r0
Alpine:v3.7	curl	7.27.0-r0, 0, 7.19.2-r0
Alpine:v3.21	curl	0, 7.52.1-r1, 7.52.1-r0
Alpine:v3.14	curl	7.19.6-r0, 7.52.1-r1, 7.52.1-r0
Alpine:v3.10	curl	7.45.0-r0, 0, 7.19.2-r0
Alpine:v3.17	curl	7.19.2-r1, 7.52.1-r1, 7.52.1-r0
Alpine:v3.19	curl	7.52.0-r0, 7.35.0-r0, 7.34.0-r1
Alpine:v3.8	curl	7.35.0-r0, 0, 7.19.4-r0
Alpine:v3.15	curl	7.52.1-r1, 0, 7.19.2-r1
Alpine:v3.23	curl	0, 7.21.4-r1, 7.21.5-r0
Alpine:v3.6	curl	7.19.2-r1, 7.19.4-r0, 7.19.5-r0
Alpine:v3.9	curl	7.19.2-r0, 7.19.2-r1, 7.19.4-r0

…and 2 more

Timeline

Jul 27, 2018 CVE Published
Dec 3, 2025 CVE Updated
Apr 30, 2026 Distribution Patch

References

https://security.alpinelinux.org/vuln/CVE-2017-2629 advisory

Open in Interactive Console →