Skip to content
Fencer Vulns
medium 4.8

CVE-2017-7468 json

In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to resume a TLS session even if the client certificate had change…

published 2018-07-16 8 y ago modified 2026-06-17 4 mo ago also EUVD-2017-16491

cvss
4.8
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.7%
EPSS 1.7% chance of exploitation in 30 days, percentile 76%
public exploits
0
none known

Summary

In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which was established by the previous certificate (or no certificate). libcurl supports by default the use of TLS session id/ticket to resume previous TLS sessions to speed up subsequent TLS handshakes. They are used when for any reason an existing TLS connection couldn't be kept alive to make the next handshake faster. This flaw is a regression and identical to CVE-2016-5419 reported on August 3rd 2016, but affecting a different version range.

Patch / fix

  • curl Debian 14, Debian 13, Debian 12 7.52.1-5

debian advisories DEBIAN-CVE-2017-7468

  • curl openSUSE Tumbleweed 7.79.1-1.1

opensuse advisories openSUSE-SU-2024:10582-1

  • curl Alpine 3.24, Alpine 3.23, Alpine 3.22 +16 more 7.54.0-r0
  • curl Alpine 3.3, Alpine 3.2 7.52.1-r1
  • curl Alpine 3.4 7.52.1-r2
  • curl Alpine 3.5 7.52.1-r3

alpine advisories ALPINE-CVE-2017-7468

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • libcurl-compat Arch Linux 7.53.0-1
  • libcurl-gnutls Arch Linux 7.53.0-1
  • lib32-libcurl-compat Arch Linux 7.53.0-1
  • lib32-libcurl-gnutls Arch Linux 7.53.0-1
  • curl Arch Linux 7.54.0-1
  • lib32-curl Arch Linux 7.54.0-1

arch linux advisories AVG-180AVG-181AVG-183AVG-184AVG-241AVG-243

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2017-7468 updated cvss 4.8

curl: TLS session resumption client cert bypass

  • Red Hat .NET Core 1.0 on Red Hat Enterprise Linux rh-dotnetcore10-curl Red Hat .NET Core 1.1 on Red Hat Enterprise Linux rh-dotnetcore11-curl Red Hat .NET Core 2.0 on Red Hat Enterprise Linux rh-dotnet20-curl Red Hat Enterprise Linux 5 curl Red Hat Enterprise Linux 6 curl, libcurl Red Hat Enterprise Linux 7 curl, libcurl
    +3 more products
    Red Hat Enterprise Virtualization 3 mingw-virt-viewer, mingw32-virt-viewer, mingw64-virt-viewer Red Hat JBoss Enterprise Web Server 3 curl Red Hat Software Collections httpd24-curl, httpd24-libcurl
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.67% chance of exploitation in the next 30 days, higher than 76% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.0 4.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
NVD 3.0 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N

Affected products

  • [UNKNOWN] curl

Classification

Weakness
  • CWE-295 Improper Certificate Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.