UBUNTU-CVE-2016-5420

See a problem?

Source

https://ubuntu.com/security/notices/UBUNTU-CVE-2016-5420

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2016/UBUNTU-CVE-2016-5420.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2016-5420

Related

Published

2016-08-03T00:00:00Z

Modified

2016-08-03T00:00:00Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

[none]

Details

curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attackers to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate.

References

Affected packages

Ubuntu:14.04:LTS / curl

Package

Name: curl
Purl: pkg:deb/ubuntu/curl@7.35.0-1ubuntu2.8?arch=src?distro=trusty

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

7.35.0-1ubuntu2.8

Affected versions

7.*

7.32.0-1ubuntu1

7.33.0-1ubuntu1

7.34.0-1ubuntu1

7.35.0-1ubuntu1

7.35.0-1ubuntu2

7.35.0-1ubuntu2.1

7.35.0-1ubuntu2.2

7.35.0-1ubuntu2.3

7.35.0-1ubuntu2.5

7.35.0-1ubuntu2.6

7.35.0-1ubuntu2.7

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "curl-udeb": "7.35.0-1ubuntu2.8",
            "libcurl3": "7.35.0-1ubuntu2.8",
            "libcurl4-gnutls-dev": "7.35.0-1ubuntu2.8",
            "libcurl3-dbgsym": "7.35.0-1ubuntu2.8",
            "libcurl3-nss": "7.35.0-1ubuntu2.8",
            "libcurl4-doc": "7.35.0-1ubuntu2.8",
            "libcurl3-udeb-dbgsym": "7.35.0-1ubuntu2.8",
            "libcurl3-gnutls-dbgsym": "7.35.0-1ubuntu2.8",
            "libcurl4-openssl-dev": "7.35.0-1ubuntu2.8",
            "libcurl4-openssl-dev-dbgsym": "7.35.0-1ubuntu2.8",
            "curl-dbgsym": "7.35.0-1ubuntu2.8",
            "curl": "7.35.0-1ubuntu2.8",
            "libcurl3-udeb": "7.35.0-1ubuntu2.8",
            "curl-udeb-dbgsym": "7.35.0-1ubuntu2.8",
            "libcurl4-nss-dev-dbgsym": "7.35.0-1ubuntu2.8",
            "libcurl3-gnutls": "7.35.0-1ubuntu2.8",
            "libcurl4-gnutls-dev-dbgsym": "7.35.0-1ubuntu2.8",
            "libcurl3-nss-dbgsym": "7.35.0-1ubuntu2.8",
            "libcurl3-dbg": "7.35.0-1ubuntu2.8",
            "libcurl4-nss-dev": "7.35.0-1ubuntu2.8"
        }
    ]
}

Ubuntu:16.04:LTS / curl

Package

Name: curl
Purl: pkg:deb/ubuntu/curl@7.47.0-1ubuntu2.1?arch=src?distro=xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

7.47.0-1ubuntu2.1

Affected versions

7.*

7.43.0-1ubuntu2

7.45.0-1ubuntu1

7.46.0-1ubuntu1

7.47.0-1ubuntu1

7.47.0-1ubuntu2

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "libcurl3": "7.47.0-1ubuntu2.1",
            "libcurl4-gnutls-dev": "7.47.0-1ubuntu2.1",
            "libcurl3-dbgsym": "7.47.0-1ubuntu2.1",
            "libcurl3-nss": "7.47.0-1ubuntu2.1",
            "libcurl4-doc": "7.47.0-1ubuntu2.1",
            "libcurl3-gnutls-dbgsym": "7.47.0-1ubuntu2.1",
            "libcurl4-openssl-dev": "7.47.0-1ubuntu2.1",
            "libcurl4-openssl-dev-dbgsym": "7.47.0-1ubuntu2.1",
            "curl-dbgsym": "7.47.0-1ubuntu2.1",
            "curl": "7.47.0-1ubuntu2.1",
            "libcurl4-nss-dev-dbgsym": "7.47.0-1ubuntu2.1",
            "libcurl3-gnutls": "7.47.0-1ubuntu2.1",
            "libcurl4-gnutls-dev-dbgsym": "7.47.0-1ubuntu2.1",
            "libcurl3-nss-dbgsym": "7.47.0-1ubuntu2.1",
            "libcurl3-dbg": "7.47.0-1ubuntu2.1",
            "libcurl4-nss-dev": "7.47.0-1ubuntu2.1"
        }
    ]
}