curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate's validity in the code that checks for a test success or failure. It ends up always thinking there's valid proof, even when there is none or if the server doesn't support the TLS extension in question. This could lead to users not detecting when a server's certificate goes invalid or otherwise be mislead that the server is in a better shape than it is in reality. This flaw also exists in the command line tool (--cert-status).
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade curl | Jul 27, 2018 | Jul 27, 2018 |
| Apple Osx Curl | — | Upgrade macOS to the latest version | Jul 19, 2017 | Jul 19, 2017 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jul 27, 2018 |
| Debian | — | Upgrade curl | Jul 30, 2024 | Jul 27, 2018 |
| Freebsd | — | Upgrade curl | Feb 23, 2017 | Feb 22, 2017 |
| Gentoo Linux | — | Upgrade net-misc/curl. | Oct 30, 2017 | Mar 28, 2017 |
| Suse | — | Upgrade curlUpgrade libcurl4-32bitUpgrade libcurl-develUpgrade libcurl4 | May 20, 2018 | Feb 22, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub