CVE-2017-7468

描述

In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which was established by the previous certificate (or no certificate). libcurl supports by default the use of TLS session id/ticket to resume previous TLS sessions to speed up subsequent TLS handshakes. They are used when for any reason an existing TLS connection couldn't be kept alive to make the next handshake faster. This flaw is a regression and identical to CVE-2016-5419 reported on August 3rd 2016, but affecting a different version range.

如何修補 CVE-2017-7468

要修補 CVE-2017-7468,請將受影響套件升級到下列已修補版本。

• —升級至 7.54.0-r0 或更新版本
• —升級至 7.52.1-5 或更新版本

CVE-2017-7468 正在被利用嗎?

低 — EPSS 為 1.9%,目前沒有觀察到大規模利用活動。

受影響套件(2)

• from 0, < 7.54.0-r0
• from 0, < 7.52.1-5

CVSS 分數

參考連結(2)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2017-7468
• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2017-7468