p PatchFirst

CVE-2016-5420

CVE-2016-5420

This page contains facts from public vulnerability sources. Check the original advisory before updating.

curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attackers to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate.

CVSS 7.5 · High · EPSS 15.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • curl Debian:12

    Affected ranges
    • ECOSYSTEM: < 7.50.1-1

    Update to 7.50.1-1

  • curl Debian:13

    Affected ranges
    • ECOSYSTEM: < 7.50.1-1

    Update to 7.50.1-1

  • curl Debian:14

    Affected ranges
    • ECOSYSTEM: < 7.50.1-1

    Update to 7.50.1-1

  • curl Ubuntu:14.04:LTS

    Versions
    • 7.32.0-1ubuntu1
    • 7.33.0-1ubuntu1
    • 7.34.0-1ubuntu1
    • 7.35.0-1ubuntu1
    • 7.35.0-1ubuntu2
    • 7.35.0-1ubuntu2.1
    • 7.35.0-1ubuntu2.2
    • 7.35.0-1ubuntu2.3
    • 7.35.0-1ubuntu2.5
    • 7.35.0-1ubuntu2.6
    • 7.35.0-1ubuntu2.7
    Affected ranges
    • ECOSYSTEM: < 7.35.0-1ubuntu2.8

    Update to 7.35.0-1ubuntu2.8

  • curl Ubuntu:16.04:LTS

    Versions
    • 7.43.0-1ubuntu2
    • 7.45.0-1ubuntu1
    • 7.46.0-1ubuntu1
    • 7.47.0-1ubuntu1
    • 7.47.0-1ubuntu2
    Affected ranges
    • ECOSYSTEM: < 7.47.0-1ubuntu2.1

    Update to 7.47.0-1ubuntu2.1

Original sources

Check your server →