Description
When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected products
- curl / curl8363656cb4e0c60a11d8531ead0ec43120b50591 – 5267ed859d545534d0c21675a2b70af5a3b6e3ef
- curl / curl8.20.0 – 8.20.0
- curl / curl8.19.0 – 8.19.0
- curl / curl8.18.0 – 8.18.0
- curl / curl8.17.0 – 8.17.0
- curl / curl8.16.0 – 8.16.0
- curl / curl8.15.0 – 8.15.0
- curl / curl8.14.1 – 8.14.1
- curl / curl8.14.0 – 8.14.0
- curl / curl8.13.0 – 8.13.0
- curl / curl8.12.1 – 8.12.1
- curl / curl8.12.0 – 8.12.0
- curl / curl8.11.1 – 8.11.1
- curl / curl8.11.0 – 8.11.0
- curl / curl8.10.1 – 8.10.1
- curl / curl8.10.0 – 8.10.0
- curl / curl8.9.1 – 8.9.1
- curl / curl8.9.0 – 8.9.0
- curl / curl8.8.0 – 8.8.0
- curl / curl8.7.1 – 8.7.1
- curl / curl8.7.0 – 8.7.0
- curl / curl8.6.0 – 8.6.0
- curl / curl8.5.0 – 8.5.0
- curl / curl8.4.0 – 8.4.0
- curl / curl8.3.0 – 8.3.0
- curl / curl8.2.1 – 8.2.1
- curl / curl8.2.0 – 8.2.0
- curl / curl8.1.2 – 8.1.2
- curl / curl8.1.1 – 8.1.1
- curl / curl8.1.0 – 8.1.0
- curl / curl8.0.1 – 8.0.1
- curl / curl8.0.0 – 8.0.0
- curl / curl7.88.1 – 7.88.1
- curl / curl7.88.0 – 7.88.0
- curl / curl7.87.0 – 7.87.0
- curl / curl7.86.0 – 7.86.0
- curl / curl7.85.0 – 7.85.0
- curl / curl7.84.0 – 7.84.0
- curl / curl7.83.1 – 7.83.1
- curl / curl7.83.0 – 7.83.0
- curl / curl7.82.0 – 7.82.0
- curl / curl7.81.0 – 7.81.0
- curl / curl7.80.0 – 7.80.0
- curl / curl7.79.1 – 7.79.1
- curl / curl7.79.0 – 7.79.0
- curl / curl7.78.0 – 7.78.0
- curl / curl7.77.0 – 7.77.0
- curl / curl7.76.1 – 7.76.1
- curl / curl7.76.0 – 7.76.0
- curl / curl7.75.0 – 7.75.0
- curl / curl7.74.0 – 7.74.0
- curl / curl7.73.0 – 7.73.0
- curl / curl7.72.0 – 7.72.0
- curl / curl7.71.1 – 7.71.1
- curl / curl7.71.0 – 7.71.0
- curl / curl7.70.0 – 7.70.0
- curl / curl7.69.1 – 7.69.1
- curl / curl7.69.0 – 7.69.0
- curl / curl7.68.0 – 7.68.0
- curl / curl7.67.0 – 7.67.0
- curl / curl7.66.0 – 7.66.0
- curl / curl7.65.3 – 7.65.3
- curl / curl7.65.2 – 7.65.2
- curl / curl7.65.1 – 7.65.1
- curl / curl7.65.0 – 7.65.0
- curl / curl7.64.1 – 7.64.1
- curl / curl7.64.0 – 7.64.0
- curl / curl7.63.0 – 7.63.0
- curl / curl7.62.0 – 7.62.0
- curl / curl7.61.1 – 7.61.1
- curl / curl7.61.0 – 7.61.0
- curl / curl7.60.0 – 7.60.0
- curl / curl7.59.0 – 7.59.0
- curl / curl7.58.0 – 7.58.0
- curl / curl7.57.0 – 7.57.0
- curl / curl7.56.1 – 7.56.1
- curl / curl7.56.0 – 7.56.0
- curl / curl7.55.1 – 7.55.1
- curl / curl7.55.0 – 7.55.0
- curl / curl7.54.1 – 7.54.1
- curl / curl7.54.0 – 7.54.0
- curl / curl7.53.1 – 7.53.1
- curl / curl7.53.0 – 7.53.0
- curl / curl7.52.1 – 7.52.1
- curl / curl7.52.0 – 7.52.0
- curl / curl7.51.0 – 7.51.0
- curl / curl7.50.3 – 7.50.3
- curl / curl7.50.2 – 7.50.2
- curl / curl7.50.1 – 7.50.1
- curl / curl7.50.0 – 7.50.0
- curl / curl7.49.1 – 7.49.1
- curl / curl7.49.0 – 7.49.0
- curl / curl7.48.0 – 7.48.0
- curl / curl7.47.1 – 7.47.1
- curl / curl7.47.0 – 7.47.0
- curl / curl7.46.0 – 7.46.0
- curl / curl7.45.0 – 7.45.0
- curl / curl8.21.0 – 8.21.0
- curl / curl7.45.0 – 8.14.2
- curl / curl8.15.0 – 8.16.1
- curl / curl8.17.0 – 8.20.1
- curl / curl8.21.0 – 8.22.0
- haxx / curl7.45.0 – 8.22.0
Updated 45m ago · 8 sources