libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were left out from the configuration match checks, making themmatch too easily.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-curlalma-upgrade-libcurlalma-upgrade-libcurl-develalma-upgrade-libcurl-minimal | Jul 26, 2022 | Jun 2, 2022 | |
| Alpine Linux | alpine-linux-upgrade-curl | Mar 26, 2024 | Jun 1, 2022 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-curlamazon-linux-ami-2-upgrade-curl-debuginfoamazon-linux-ami-2-upgrade-libcurlamazon-linux-ami-2-upgrade-libcurl-devel | Sep 30, 2022 | Jun 2, 2022 | |
| Amazon_linux | — | amazon-linux-upgrade-curl | Dec 10, 2022 | May 11, 2022 |
| Amazon_linux_2023 | amazon-linux-2023-upgrade-curlamazon-linux-2023-upgrade-curl-debuginfoamazon-linux-2023-upgrade-curl-debugsourceamazon-linux-2023-upgrade-curl-minimalamazon-linux-2023-upgrade-curl-minimal-debuginfoamazon-linux-2023-upgrade-libcurlamazon-linux-2023-upgrade-libcurl-debuginfoamazon-linux-2023-upgrade-libcurl-develamazon-linux-2023-upgrade-libcurl-minimalamazon-linux-2023-upgrade-libcurl-minimal-debuginfo | Feb 17, 2025 | May 11, 2022 | |
| Arch Linux | arch-linux-upgrade-latest | Jul 11, 2025 | Jun 1, 2022 | |
| Centos_linux | — | centos-upgrade-curlcentos-upgrade-curl-debuginfocentos-upgrade-curl-debugsourcecentos-upgrade-curl-minimalcentos-upgrade-curl-minimal-debuginfocentos-upgrade-libcurlcentos-upgrade-libcurl-debuginfocentos-upgrade-libcurl-develcentos-upgrade-libcurl-minimalcentos-upgrade-libcurl-minimal-debuginfo | Jul 5, 2022 | Jun 2, 2022 |
| Debian | debian-upgrade-curl | Aug 30, 2022 | Jun 2, 2022 | |
| Freebsd | freebsd-upgrade-package-curl | Nov 4, 2022 | May 13, 2022 | |
| Gentoo Linux | gentoo-linux-upgrade-net-misc-curl | Dec 19, 2022 | Jun 2, 2022 | |
| Huawei Euleros 2_0_sp10 | huawei-euleros-2_0_sp10-upgrade-curlhuawei-euleros-2_0_sp10-upgrade-libcurl | Aug 18, 2022 | Jun 2, 2022 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-curlhuawei-euleros-2_0_sp8-upgrade-libcurlhuawei-euleros-2_0_sp8-upgrade-libcurl-devel | Aug 18, 2022 | Jun 2, 2022 | |
| Huawei Euleros 2_0_sp9 | huawei-euleros-2_0_sp9-upgrade-curlhuawei-euleros-2_0_sp9-upgrade-libcurl | Sep 14, 2022 | Jun 2, 2022 | |
| Ibm Aix | ibm-aix-curl_advisory2 | Jul 27, 2023 | Jun 2, 2022 | |
| Oracle_linux | — | oracle-linux-upgrade-curloracle-linux-upgrade-curl-minimaloracle-linux-upgrade-libcurloracle-linux-upgrade-libcurl-develoracle-linux-upgrade-libcurl-minimal | Jun 30, 2022 | May 11, 2022 |
| Redhat_linux | no-fix-redhat-rpm-packageredhat-upgrade-curlredhat-upgrade-curl-debuginforedhat-upgrade-curl-debugsourceredhat-upgrade-curl-minimalredhat-upgrade-curl-minimal-debuginforedhat-upgrade-libcurlredhat-upgrade-libcurl-debuginforedhat-upgrade-libcurl-develredhat-upgrade-libcurl-minimalredhat-upgrade-libcurl-minimal-debuginfo | Jul 5, 2022 | Jun 2, 2022 | |
| Rocky_linux | rocky-upgrade-curlrocky-upgrade-curl-debuginforocky-upgrade-curl-debugsourcerocky-upgrade-libcurlrocky-upgrade-libcurl-debuginforocky-upgrade-libcurl-develrocky-upgrade-libcurl-minimalrocky-upgrade-libcurl-minimal-debuginfo | Jul 11, 2022 | Jun 2, 2022 | |
| Splunk | splunk-upgrade-latest | Sep 30, 2025 | Jun 1, 2022 | |
| Suse | — | suse-upgrade-curlsuse-upgrade-libcurl-develsuse-upgrade-libcurl-devel-32bitsuse-upgrade-libcurl4suse-upgrade-libcurl4-32bit | Oct 26, 2022 | Jun 2, 2022 |
| Ubuntu | ubuntu-upgrade-curlubuntu-upgrade-libcurl3-gnutlsubuntu-upgrade-libcurl3-nssubuntu-upgrade-libcurl4 | May 12, 2022 | May 11, 2022 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Jun 1, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub