The darwinssl_connect_step1 function in lib/vtls/curl_darwinssl.c in libcurl 7.31.0 through 7.39.0, when using the DarwinSSL (aka SecureTransport) back-end for TLS, does not check if a cached TLS session validated the certificate when reusing the session, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Information
Published : 2015-01-15 07:59
Updated : 2017-06-30 18:29
NVD link : CVE-2014-8151
Mitre link : CVE-2014-8151
JSON object : View
CWE
Products Affected
apple
- mac_os_x
haxx
- libcurl