Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
The darwinssl_connect_step1 function in lib/vtls/curl_darwinssl.c in libcurl 7.31.0 through 7.39.0, when using the DarwinSSL (aka SecureTransport) back-end for TLS, does not check if a cached TLS session validated the certificate when reusing the session, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Haxx libcurl 安全漏洞
Vulnerability Description
Haxx libcurl是瑞典Haxx公司的一个免费、开源的客户端URL传输库。该库支持FTP、FTPS、TFTP、HTTP等。 Haxx libcurl 7.31.0版本至7.39.0版本的lib/vtls/curl_darwinssl.c文件中的‘darwinssl_connect_step1’函数存在安全漏洞，当程序使用DarwinSSL back-end时，没有正确验证TLS会话的证书。攻击者可借助特制的证书利用该漏洞实施中间人攻击，欺骗服务器。
CVSS Information
N/A
Vulnerability Type
N/A