CVE-2016-5420
Publicada em · Atualizada em
8Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 15%
probabilidade de exploração
15%top 3% das CVEs
exploração observada
nãonenhuma fonte reporta
curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attackers to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate.
Produtos afetados
n/a · n/aReferências
http://lists.opensuse.org/opensuse-updates/2016-09/msg00011.htmlhttp://lists.opensuse.org/opensuse-updates/2016-09/msg00094.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2575.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2957.htmlhttps://access.redhat.com/errata/RHSA-2018:3558https://curl.haxx.se/docs/adv_20160803B.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GLPXQQKURBQFM4XM6645VRPTOE2AWG33/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3GQH4V3XAQ5Z53AMQRDEC3C3UHTW7QR/https://security.gentoo.org/glsa/201701-47https://source.android.com/security/bulletin/2016-12-01.htmlhttps://www.tenable.com/security/tns-2016-18http://www.debian.org/security/2016/dsa-3638