REDHAT-BUG-2496759: Medium severity libcurl libcurl vulnerability
libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse.
libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for this issue to matter?
An application must reuse libcurl connections from its connection pool while changing mTLS client-certificate configuration between transfers. The affected omitted match checks are specifically related to client-certificate private-key options.
Who is most likely exposed?
Applications that perform multiple transfers through the same libcurl handle or shared connection pool and use different mTLS private-key settings are the relevant exposure scenario. Transfers that do not use client certificates, or that do not reuse connections across differing mTLS configurations, are not described as affected.
What can be done if an update cannot be applied immediately?
Avoid reusing connections when changing mTLS client-certificate or private-key configuration between transfers. Using separate connection pools or otherwise ensuring that transfers with different client-key settings cannot share a pooled connection reduces the described risk.
How can an application identify potentially affected behavior?
Review whether it changes libcurl client-certificate private-key-related options between transfers while retaining previously created connections for reuse. A potential issue exists if a later transfer can be matched to and reuse a connection established with different mTLS private-key settings.