Search for vulnerabilities
Vulnerability details: VCID-h5nc-szhe-aaaj
Vulnerability ID VCID-h5nc-szhe-aaaj
Aliases CVE-2017-7468
Summary In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which was established by the previous certificate (or no certificate). libcurl supports by default the use of TLS session id/ticket to resume previous TLS sessions to speed up subsequent TLS handshakes. They are used when for any reason an existing TLS connection couldn't be kept alive to make the next handshake faster. This flaw is a regression and identical to CVE-2016-5419 reported on August 3rd 2016, but affecting a different version range.
Status Published
Exploitability 0.5
Weighted Severity 6.8
Risk 3.4
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-295 Improper Certificate Validation
CWE-305 Authentication Bypass by Primary Weakness
System Score Found at
cvssv3 4.8 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-7468.json
epss 0.00285 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00285 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00285 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00285 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00459 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00459 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00459 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00459 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00459 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00459 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00459 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00459 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00459 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00459 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00459 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00705 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00705 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00732 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00732 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00732 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00732 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00732 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00732 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00732 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00732 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00732 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00732 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00732 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00732 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00732 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00732 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00732 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00732 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00732 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00732 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00732 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00732 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00732 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00732 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00732 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00732 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00732 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00732 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00732 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00732 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00732 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00732 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00732 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00732 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00732 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00732 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00732 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00732 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00732 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00732 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00732 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00732 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00747 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00747 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00747 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00747 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00747 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00747 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00747 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00747 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00747 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00747 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00747 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00747 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00747 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00747 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00747 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00747 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00747 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00747 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00747 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00747 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00747 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00747 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00747 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00747 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00747 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.00747 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
epss 0.01143 https://api.first.org/data/v1/epss?cve=CVE-2017-7468
rhbs medium https://bugzilla.redhat.com/show_bug.cgi?id=1443381
cvssv3.1 High https://curl.se/docs/CVE-2017-7468.html
cvssv2 2.1 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv2 5.0 https://nvd.nist.gov/vuln/detail/CVE-2017-7468
cvssv3 7.5 https://nvd.nist.gov/vuln/detail/CVE-2017-7468
archlinux Medium https://security.archlinux.org/AVG-180
archlinux Medium https://security.archlinux.org/AVG-181
archlinux Medium https://security.archlinux.org/AVG-183
archlinux Medium https://security.archlinux.org/AVG-184
archlinux Medium https://security.archlinux.org/AVG-241
archlinux Medium https://security.archlinux.org/AVG-243
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-7468.json
https://api.first.org/data/v1/epss?cve=CVE-2017-7468
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7468
https://curl.haxx.se/docs/adv_20170419.html
https://curl.se/docs/CVE-2017-7468.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7468
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://security.gentoo.org/glsa/201709-14
http://www.securityfocus.com/bid/97962
http://www.securitytracker.com/id/1038341
1443381 https://bugzilla.redhat.com/show_bug.cgi?id=1443381
ASA-201704-12 https://security.archlinux.org/ASA-201704-12
AVG-180 https://security.archlinux.org/AVG-180
AVG-181 https://security.archlinux.org/AVG-181
AVG-183 https://security.archlinux.org/AVG-183
AVG-184 https://security.archlinux.org/AVG-184
AVG-241 https://security.archlinux.org/AVG-241
AVG-243 https://security.archlinux.org/AVG-243
cpe:2.3:a:haxx:libcurl:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:haxx:libcurl:*:*:*:*:*:*:*:*
CVE-2017-7468 https://nvd.nist.gov/vuln/detail/CVE-2017-7468
USN-3262-1 https://usn.ubuntu.com/3262-1/
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-7468.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:H/Au:S/C:P/I:N/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2017-7468
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2017-7468
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.68296
EPSS Score 0.00285
Published At Dec. 17, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.