Arch Linux Security Advisory ASA-201704-12 ========================================== Severity: Medium Date : 2017-04-29 CVE-ID : CVE-2017-7468 Package : curl Type : certificate verification bypass Remote : Yes Link : https://security.archlinux.org/AVG-241 Summary ======= The package curl before version 7.54.0-1 is vulnerable to certificate verification bypass. Resolution ========== Upgrade to 7.54.0-1. # pacman -Syu "curl>=7.54.0-1" The problem has been fixed upstream in version 7.54.0. Workaround ========== None. Description =========== libcurl from 7.52.0 to and including 7.53.1 would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which was established by the previous certificate (or no certificate). This flaw is a regression and identical to CVE-2016-5419 reported on August 3rd 2016, but affecting a different version range. Impact ====== An attacker can bypass a client certificate check by taking advantage of TLS session resumption to reuse a previously established session. References ========== https://curl.haxx.se/docs/adv_20170419.html https://security.archlinux.org/CVE-2017-7468