CVE-2016-7141

What it actually does

The flaw permits remote attackers to hijack TLS authentication by reusing a previously loaded client certificate from file (via libnsspem.so with NSS) for connections where no certificate was explicitly set.

Why it matters to the business

Attackers can impersonate authenticated clients over TLS, leading to unauthorized access or data exposure in affected applications; 331 downstream dependents amplify potential reach across ecosystems using the vulnerable pillow packaging.

How an attack unfolds

An attacker initiates a TLS connection to a target using curl/libcurl built with NSS; when libnsspem.so is present at runtime, the library reuses a prior client certificate loaded from file even though none was configured for the current session, bypassing intended authentication checks.

How to fix it

Upgrade affected packages to fixed versions: pillow (Bitnami) to 8.1.1 or later, which resolves the underlying curl/libcurl issue by updating to 7.50.2+; rebuild any custom NSS-enabled clients to disable or update libnsspem.so usage.

How to confirm the fix worked

Verify curl/libcurl versions are at least 7.50.2; confirm libnsspem.so is not loaded or is patched; test TLS connections with explicit certificate settings to ensure reuse does not occur.

Typical attack path

1. Identify targets using vulnerable curl/libcurl with NSS and libnsspem.so available.
2. Trigger or observe a prior TLS session that loads a client certificate from file.
3. Initiate a new TLS connection without specifying a certificate.
4. Leverage certificate reuse to hijack authentication and impersonate the client.

How to detect it

Review application and system logs for unexpected client certificate usage in TLS handshakes; search for processes loading libnsspem.so alongside curl before version 7.50.2; correlate with network traffic showing authentication bypass patterns.

What your security team should do

• Immediately upgrade pillow (Bitnami) to 8.1.1 across all instances.
• Audit and rebuild any custom builds using NSS-backed curl to eliminate libnsspem.so dependency.
• Monitor for TLS authentication anomalies in application logs post-upgrade.