cURL OCSP Stapling Verification Vulnerability

Last Update Date: 23 Feb 2017 09:03 Release Date: 23 Feb 2017 4326 Views

RISK: Medium Risk

TYPE: Clients - Browsers

A vulnerability has been identified in cURL. A remote user can bypass security controls on the target system by exploiting the TLS Certificate Status Request extension checking not properly processed.

Impact

Security Restriction Bypass

System / Technologies affected

7.52.0 - 7.52.1

Solutions

Before installation of the software, please visit the software manufacturer web-site for more details.

The vendor has issued a fix (7.53.0):
https://curl.haxx.se/docs/adv_20170222.html

Vulnerability Identifier

CVE-2017-2629

Source

SecurityTracker