CVE-2017-7468

In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt
to resume a TLS session even if the client certificate had changed. That is
unacceptable since a server by specification is allowed to skip the client
certificate check on resume, and may instead use the old identity which was
established by the previous certificate (or no certificate). libcurl
supports by default the use of TLS session id/ticket to resume previous TLS
sessions to speed up subsequent TLS handshakes. They are used when for any
reason an existing TLS connection couldn’t be kept alive to make the next
handshake faster. This flaw is a regression and identical to CVE-2016-5419
reported on August 3rd 2016, but affecting a different version range.

Bugs

• <https://github.com/curl/curl/issues/1341&gt;

Notes