« List of all CVEs

CVE-2016-5420

Published: 8/10/2016 Last updated: 8/6/2024 Reserved: 6/10/2016

curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attackers to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate.

CNA assigner: redhat (53f830b8-0a3f-465b-8143-3b8a9948e749) Requested by: n/a

Opam packages affected (3)

conf-libcurl conf-mingw-w64-curl-i686 conf-mingw-w64-curl-x86_64

Products affected (1)

Product	Vendor	Version
n/a	n/a	QCA6174A

References (36)