KLA10859 Security bypass vulnerabilities in cURL

Multiple serious vulnerabilities have been found in cURL. Malicious users can exploit these vulnerabilities to bypass security restrictions.

Below is a complete list of vulnerabilities

1. Use-after-free vulnerability can be exploited to control which connection is used;
2. An improper TLS connection reuse handling can be exploited remotely via connection manipulations to hijack authentication;
3. An improper TLS certificate change handling can be exploited remotely via connection manipulations to bypass security restrictions.

Technical details

The curl command line tool is also affected because of these flaws.

All vulnerabilities were found in libcurl library.

Original advisories

cURL vulnerabilities table and advisories

Related products

cURL

CVE list

CVE-2016-5421 high

CVE-2016-5420 warning

CVE-2016-5419 warning

Solution

Update to the latest version or apply patchespatch for CVE-2016-5420cURL download pagepatch for CVE-2016-5419

patch for CVE-2016-5421

Impacts

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

Affected Products

• cURL and libcurl versions earlier than 7.50.1