curl / Docs / Security / TLS session resumption client cert bypass

TLS session resumption client cert bypass (again)

Project curl Security Advisory, April 19th 2017 - Permalink

VULNERABILITY

libcurl would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which was established by the previous certificate (or no certificate).

libcurl supports by default the use of TLS session id/ticket to resume previous TLS sessions to speed up subsequent TLS handshakes. They are used when for any reason an existing TLS connection couldn't be kept alive to make the next handshake faster.

This flaw is a regression and identical to CVE-2016-5419 reported on August 3rd 2016, but affecting a different version range.

We are not aware of any exploit of this flaw.

INFO

This flaw also affects the curl command line tool.

For version 7.52.0, we rearranged a lot of TLS code to bring support for HTTPS proxies, which unfortunately made us accidentally bring this old flaw back!

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2017-7468 to this issue.

AFFECTED VERSIONS

This flaw is relevant for all versions of curl and libcurl that support TLS and client certificates.

libcurl is used by many applications, but not always advertised as such!

THE SOLUTION

TLS session resumption is disabled when a client certificate is used so that a subsequent connection attempt to the same server cannot risk getting a previously authenticated session resumed.

A patch for CVE-2017-7468 is available.

RECOMMENDATIONS

We suggest you take one of the following actions immediately, in order of preference:

A - Upgrade curl and libcurl to version 7.54.0

B - Apply the patch to your version and rebuild

C - Set CURLOPT_SSL_SESSIONID_CACHE to 0L when using client certificates

TIME LINE

It was first reported to the curl project on March 21, 2017. We contacted distros@openwall on April 10.

libcurl 7.54.0 was released on April 19 2017, coordinated with the publication of this advisory.

CREDITS

Reported by lijian996@users.noreply.github.com. Patch by Ray Satiro.

Thanks a lot!