Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2016-5419: curl/libcurl can reuse old client certificate on TLS resume
CVE-2016-5419 · published 10 years ago
Summary
The curl command-line tool and its library may continue using a previous client certificate when a secure connection is reestablished quickly. This can cause the server to accept the old identity instead of the new one you intended, potentially exposing your system to unauthorized access. Update curl to the latest version or disable session resumption if you rely on changing client certificates.
What to do
- Update debian curl to version 7.50.1-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | curl |
< 7.50.1-1 Fix: upgrade to 7.50.1-1
|
| Debian:13 | debian | curl |
< 7.50.1-1 Fix: upgrade to 7.50.1-1
|
| Debian:14 | debian | curl |
< 7.50.1-1 Fix: upgrade to 7.50.1-1
|
| – | haxx | libcurl |
<= 7.50.0 cpe:2.3:a:haxx:libcurl:*:*:*:*:*:*:*:* |
| – | debian | debian_linux |
8.0 cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* |
| – | opensuse | leap |
42.1 cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:* |
Original advisory text
TLS session resumption client cert bypass
libcurl would attempt to resume a TLS session even if the client certificate
had changed. That is unacceptable since a server by specification is allowed
to skip the client certificate check on resume, and may instead use the old
identity which was established by the previous certificate (or no
certificate).
libcurl supports by default the use of TLS session id/ticket to resume
previous TLS sessions to speed up subsequent TLS handshakes. They are used
when for any reason an existing TLS connection could not be kept alive to make
the next handshake faster.
had changed. That is unacceptable since a server by specification is allowed
to skip the client certificate check on resume, and may instead use the old
identity which was established by the previous certificate (or no
certificate).
libcurl supports by default the use of TLS session id/ticket to resume
previous TLS sessions to speed up subsequent TLS handshakes. They are used
when for any reason an existing TLS connection could not be kept alive to make
the next handshake faster.
References
- https://security-tracker.debian.org/tracker/CVE-2016-5419 Vendor Advisory
- http://lists.opensuse.org/opensuse-updates/2016-09/msg00011.html
- https://access.redhat.com/errata/RHSA-2018:3558
- http://lists.opensuse.org/opensuse-updates/2016-09/msg00094.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-2575.html
- http://rhn.redhat.com/errata/RHSA-2016-2957.html
- http://www.debian.org/security/2016/dsa-3638 Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- http://www.securityfocus.com/bid/92292
- http://www.securityfocus.com/bid/92319
- http://www.securitytracker.com/id/1036538
- http://www.securitytracker.com/id/1038341
- http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slack...
- http://www.ubuntu.com/usn/USN-3048-1
- https://curl.haxx.se/docs/adv_20160803A.html Mitigation Patch Vendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
- https://security.gentoo.org/glsa/201701-47
- https://source.android.com/security/bulletin/2016-12-01.html
- https://www.tenable.com/security/tns-2016-18
Severity
7.5
High
Type
CWE-310Cryptographic Issues
Timeline
Published3 Aug 2016
Updated24 Oct 2026
First seen25 Apr 2026
Track software like this
Free during beta