CVE-2016-5420
High · 7.5CVSS
7.5
EPSS
15.4%
Published
Aug 10, 2016
CISA due date
—
The record
curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attackers to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Alpine:v3.10 | curl | 0 | 7.50.1-r0 |
| Alpine:v3.11 | curl | 0 | 7.50.1 |
| Alpine:v3.12 | curl | 0 | 7.50.1-r0 |
| Alpine:v3.13 | curl | 0 | 7.50.1-r0 |
| Alpine:v3.14 | curl | 0 | 7.50.1-r0 |
| Alpine:v3.15 | curl | 0 | 7.50.1-r0 |
| Alpine:v3.16 | curl | 0 | 7.50.1-r0 |
| Alpine:v3.17 | curl | 0 | 7.50.1-r0 |
| Alpine:v3.18 | curl | 0 | 7.50.1-r0 |
| Alpine:v3.19 | curl | 0 | 7.50.1-r0 |
| Alpine:v3.2 | curl | 0 | 7.49.1-r1 |
| Alpine:v3.20 | curl | 0 | 7.50.1-r0 |
| Alpine:v3.21 | curl | 0 | 7.50.1-r0 |
| Alpine:v3.22 | curl | 0 | 7.50.1-r0 |
| Alpine:v3.3 | curl | 0 | 7.49.1-r1 |
| Alpine:v3.4 | curl | 0 | 7.50.1-r0 |
| Alpine:v3.5 | curl | 0 | 7.50.1-r0 |
| Alpine:v3.6 | curl | 0 | 7.50.1 |
| Alpine:v3.7 | curl | 0 | 7.50.1 |
| Alpine:v3.8 | curl | 0 | 7.50.1 |
| Alpine:v3.9 | curl | 0 | 7.50.1-r0 |
| Debian:11 | curl | 0 | 7.50.1-1 |
| Debian:12 | curl | 0 | 7.50.1-1 |
| Debian:13 | curl | 0 | 7.50.1-1 |
| Debian:7 | curl | 0 | 7.26.0-1+wheezy14 |
| Debian:8 | curl | 0 | 7.38.0-4+deb8u4 |
| Mageia:5 | curl | 0 | 7.40.0-3.4.mga5 |
| Red Hat:enterprise_linux:7::client | curl | 0 | 0:7.29.0-35.el7 |
| Red Hat:enterprise_linux:7::client | curl-debuginfo | 0 | 0:7.29.0-35.el7 |
| Red Hat:enterprise_linux:7::client | libcurl | 0 | 0:7.29.0-35.el7 |
| Red Hat:enterprise_linux:7::client | libcurl-devel | 0 | 0:7.29.0-35.el7 |
| Red Hat:enterprise_linux:7::computenode | curl | 0 | 0:7.29.0-35.el7 |
| Red Hat:enterprise_linux:7::computenode | curl-debuginfo | 0 | 0:7.29.0-35.el7 |
| Red Hat:enterprise_linux:7::computenode | libcurl | 0 | 0:7.29.0-35.el7 |
| Red Hat:enterprise_linux:7::computenode | libcurl-devel | 0 | 0:7.29.0-35.el7 |
| Red Hat:enterprise_linux:7::server | curl | 0 | 0:7.29.0-35.el7 |
| Red Hat:enterprise_linux:7::server | curl-debuginfo | 0 | 0:7.29.0-35.el7 |
| Red Hat:enterprise_linux:7::server | libcurl | 0 | 0:7.29.0-35.el7 |
| Red Hat:enterprise_linux:7::server | libcurl-devel | 0 | 0:7.29.0-35.el7 |
| Red Hat:enterprise_linux:7::workstation | curl | 0 | 0:7.29.0-35.el7 |
| Red Hat:enterprise_linux:7::workstation | curl-debuginfo | 0 | 0:7.29.0-35.el7 |
| Red Hat:enterprise_linux:7::workstation | libcurl | 0 | 0:7.29.0-35.el7 |
| Red Hat:enterprise_linux:7::workstation | libcurl-devel | 0 | 0:7.29.0-35.el7 |
| Red Hat:rhel_software_collections:3::el6 | httpd24-curl | 0 | 0:7.61.1-1.el6 |
| Red Hat:rhel_software_collections:3::el6 | httpd24-curl-debuginfo | 0 | 0:7.61.1-1.el6 |
| Red Hat:rhel_software_collections:3::el6 | httpd24-httpd | 0 | 0:2.4.34-7.el6 |
| Red Hat:rhel_software_collections:3::el6 | httpd24-httpd-debuginfo | 0 | 0:2.4.34-7.el6 |
| Red Hat:rhel_software_collections:3::el6 | httpd24-httpd-devel | 0 | 0:2.4.34-7.el6 |
| Red Hat:rhel_software_collections:3::el6 | httpd24-httpd-manual | 0 | 0:2.4.34-7.el6 |
| Red Hat:rhel_software_collections:3::el6 | httpd24-httpd-tools | 0 | 0:2.4.34-7.el6 |
| Red Hat:rhel_software_collections:3::el6 | httpd24-libcurl | 0 | 0:7.61.1-1.el6 |
| Red Hat:rhel_software_collections:3::el6 | httpd24-libcurl-devel | 0 | 0:7.61.1-1.el6 |
| Red Hat:rhel_software_collections:3::el6 | httpd24-libnghttp2 | 0 | 0:1.7.1-7.el6 |
| Red Hat:rhel_software_collections:3::el6 | httpd24-libnghttp2-devel | 0 | 0:1.7.1-7.el6 |
| Red Hat:rhel_software_collections:3::el6 | httpd24-mod_ldap | 0 | 0:2.4.34-7.el6 |
| Red Hat:rhel_software_collections:3::el6 | httpd24-mod_proxy_html | 0 | 1:2.4.34-7.el6 |
| Red Hat:rhel_software_collections:3::el6 | httpd24-mod_session | 0 | 0:2.4.34-7.el6 |
| Red Hat:rhel_software_collections:3::el6 | httpd24-mod_ssl | 0 | 1:2.4.34-7.el6 |
| Red Hat:rhel_software_collections:3::el6 | httpd24-nghttp2 | 0 | 0:1.7.1-7.el6 |
| Red Hat:rhel_software_collections:3::el6 | httpd24-nghttp2-debuginfo | 0 | 0:1.7.1-7.el6 |
| Red Hat:rhel_software_collections:3::el7 | httpd24-curl | 0 | 0:7.61.1-1.el7 |
| Red Hat:rhel_software_collections:3::el7 | httpd24-curl-debuginfo | 0 | 0:7.61.1-1.el7 |
| Red Hat:rhel_software_collections:3::el7 | httpd24-httpd | 0 | 0:2.4.34-7.el7 |
| Red Hat:rhel_software_collections:3::el7 | httpd24-httpd-debuginfo | 0 | 0:2.4.34-7.el7 |
| Red Hat:rhel_software_collections:3::el7 | httpd24-httpd-devel | 0 | 0:2.4.34-7.el7 |
| Red Hat:rhel_software_collections:3::el7 | httpd24-httpd-manual | 0 | 0:2.4.34-7.el7 |
| Red Hat:rhel_software_collections:3::el7 | httpd24-httpd-tools | 0 | 0:2.4.34-7.el7 |
| Red Hat:rhel_software_collections:3::el7 | httpd24-libcurl | 0 | 0:7.61.1-1.el7 |
| Red Hat:rhel_software_collections:3::el7 | httpd24-libcurl-devel | 0 | 0:7.61.1-1.el7 |
| Red Hat:rhel_software_collections:3::el7 | httpd24-libnghttp2 | 0 | 0:1.7.1-7.el7 |
| Red Hat:rhel_software_collections:3::el7 | httpd24-libnghttp2-devel | 0 | 0:1.7.1-7.el7 |
| Red Hat:rhel_software_collections:3::el7 | httpd24-mod_ldap | 0 | 0:2.4.34-7.el7 |
| Red Hat:rhel_software_collections:3::el7 | httpd24-mod_md | 0 | 0:2.4.34-7.el7 |
| Red Hat:rhel_software_collections:3::el7 | httpd24-mod_proxy_html | 0 | 1:2.4.34-7.el7 |
| Red Hat:rhel_software_collections:3::el7 | httpd24-mod_session | 0 | 0:2.4.34-7.el7 |
| Red Hat:rhel_software_collections:3::el7 | httpd24-mod_ssl | 0 | 1:2.4.34-7.el7 |
| Red Hat:rhel_software_collections:3::el7 | httpd24-nghttp2 | 0 | 0:1.7.1-7.el7 |
| Red Hat:rhel_software_collections:3::el7 | httpd24-nghttp2-debuginfo | 0 | 0:1.7.1-7.el7 |
| SUSE:Linux Enterprise Desktop 12 SP1 | curl | 0 | 7.37.0-28.1 |
| SUSE:Linux Enterprise Point of Sale 11 SP3 | curl | 0 | 7.19.7-1.61.1 |
| SUSE:Linux Enterprise Server 11 SP3-LTSS | curl | 0 | 7.19.7-1.61.1 |
| SUSE:Linux Enterprise Server 11 SP3-LTSS | curl-openssl1 | 0 | 7.19.7-1.61.1 |
| SUSE:Linux Enterprise Server 11 SP3-TERADATA | curl | 0 | 7.19.7-1.61.1 |
| SUSE:Linux Enterprise Server 11 SP3-TERADATA | curl-openssl1 | 0 | 7.19.7-1.61.1 |
| SUSE:Linux Enterprise Server 11 SP4 | curl | 0 | 7.19.7-1.61.1 |
| SUSE:Linux Enterprise Server 11-SECURITY | curl-openssl1 | 0 | 7.19.7-1.61.1 |
| SUSE:Linux Enterprise Server 12 SP1 | curl | 0 | 7.37.0-28.1 |
| SUSE:Linux Enterprise Server for SAP Applications 11 SP4 | curl | 0 | 7.19.7-1.61.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | curl | 0 | 7.37.0-28.1 |
| SUSE:Linux Enterprise Software Development Kit 11 SP4 | curl | 0 | 7.19.7-1.61.1 |
| SUSE:Linux Enterprise Software Development Kit 12 SP1 | curl | 0 | 7.37.0-28.1 |
| SUSE:Manager 2.1 | curl | 0 | 7.19.7-1.61.1 |
| SUSE:Manager Proxy 2.1 | curl | 0 | 7.19.7-1.61.1 |
| SUSE:OpenStack Cloud 5 | curl | 0 | 7.19.7-1.61.1 |
| SUSE:Studio Onsite 1.3 | curl | 0 | 7.19.7-1.20.42.1 |
| SUSE:Studio Onsite 1.3 | curl | 0 | 7.19.7-1.20.47.2 |
| Ubuntu:14.04:LTS | curl | 0 | 7.35.0-1ubuntu2.8 |
| Ubuntu:16.04:LTS | curl | 0 | 7.47.0-1ubuntu2.1 |
Related vulnerabilities
- CVE-2021-22898 curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line… Also affects curl
- CVE-2019-5481 Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3. Also affects curl
- CVE-2019-5482 Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. Also affects curl
- CVE-2019-5436 A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code… Also affects curl
- CVE-2017-8817 The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to… Also affects curl
- CVE-2017-8816 The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms… Also affects curl
- CVE-2017-1000257 An IMAP FETCH response line indicates the size of the returned data, in number of bytes. Also affects curl
- CVE-2016-7167 Multiple integer overflows in the (1) curl_escape, (2) curl_easy_escape, (3)… Also affects curl