CVE-2017-2629

Description

curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the servers certificates validity in the code that checks for a test success or failure. It ends up always thinking theres valid proof, even when there is none or if the server doesnt support the TLS extension in question. This could lead to users not detecting when a servers certificate goes invalid or otherwise be mislead that the server is in a better shape than it is in reality. This flaw also exists in the command line tool (--cert-status).

Risk Information

Base Score

6.5

MODERATE

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS Score

Exploitation Probability

0.363

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2017-1000100,CVE-2017-1000101,CVE-2017-1000254,CVE-2017-2629 are affected in Curl For Windows 7.52.1	Windows
Vulnerabilities CVE-2017-2629 are fixed in Curl For Windows 7.53.0	Windows

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234