Description
With the wolfSSL backend, when CA caching is enabled and an `CURLOPT_SSL_CTX_FUNCTION` callback replaces the trust store, libcurl can silently reinstall the cached store after the callback returns. A certificate trusted by the cached store but rejected by the callback-selected store is then incorrectly accepted.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected products
- curl / curl0f2876b2c33f6784a27b6f7345bd8cd95b46352a – ed0338befd1d865a8ea1fbaa90013a096dedd07a
- curl / curl8.20.0 – 8.20.0
- curl / curl8.19.0 – 8.19.0
- curl / curl8.18.0 – 8.18.0
- curl / curl8.17.0 – 8.17.0
- curl / curl8.16.0 – 8.16.0
- curl / curl8.15.0 – 8.15.0
- curl / curl8.14.1 – 8.14.1
- curl / curl8.14.0 – 8.14.0
- curl / curl8.13.0 – 8.13.0
- curl / curl8.12.1 – 8.12.1
- curl / curl8.12.0 – 8.12.0
- curl / curl8.11.1 – 8.11.1
- curl / curl8.11.0 – 8.11.0
- curl / curl8.10.1 – 8.10.1
- curl / curl8.10.0 – 8.10.0
- curl / curl8.9.1 – 8.9.1
- curl / curl8.21.0 – 8.21.0
- curl / curl8.9.1 – 8.14.2
- curl / curl8.15.0 – 8.16.1
- curl / curl8.17.0 – 8.20.1
- curl / curl8.21.0 – 8.22.0
- haxx / curl8.9.1 – 8.22.0
Updated 45m ago · 8 sources