N/A

curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate's validity in the code that checks for a test success or failure. It ends up always thinking there's valid proof, even when there is none or if the server doesn't support the TLS extension in question. This could lead to users not detecting when a server's certificate goes invalid or otherwise be mislead that the server is in a better shape than it is in reality. This flaw also exists in the command line tool (--cert-status).

N/A

证书验证不恰当

Haxx curl和libcurl 安全漏洞

Haxx curl和libcurl都是瑞典Haxx公司的产品。curl是一套利用URL语法在命令行下工作的文件传输工具。libcurl是一个免费、开源的客户端URL传输库。 Haxx curl和libcurl 7.52.0版本至7.52.1版本存在安全绕过漏洞。攻击者可利用该漏洞实施中间人攻击，绕过安全限制。

N/A

N/A