CVEvulnerability

CVE-2016-5420

7.5 HIGH Published 2016-08-10 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2016-08-10
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
Weaknesses
CWE-285

Description

curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attackers to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate.

Affected configurations

• debian debian linux 8.0 • haxx libcurl (<= 7.50.0) • opensuse leap 42.1

Related

Weakness · CWE (1)

  • CWE-285 Improper Authorization weakness

References