High severity7.5NVD Advisory· Published Aug 10, 2016· Updated Jun 17, 2026
CVE-2016-5420
CVE-2016-5420
Description
curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attackers to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
20- osv-coords17 versionspkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP1pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Point%20of%20Sale%2011%20SP3pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP3-LTSSpkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP3-TERADATApkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP4pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2011%20SP4pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP1pkg:rpm/suse/curl&distro=SUSE%20Manager%202.1pkg:rpm/suse/curl&distro=SUSE%20Manager%20Proxy%202.1pkg:rpm/suse/curl&distro=SUSE%20OpenStack%20Cloud%205pkg:rpm/suse/curl&distro=SUSE%20Studio%20Onsite%201.3pkg:rpm/suse/curl-openssl1&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP3-LTSSpkg:rpm/suse/curl-openssl1&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP3-TERADATApkg:rpm/suse/curl-openssl1&distro=SUSE%20Linux%20Enterprise%20Server%2011-SECURITY
< 7.37.0-28.1+ 16 more
- (no CPE)range: < 7.37.0-28.1
- (no CPE)range: < 7.19.7-1.61.1
- (no CPE)range: < 7.19.7-1.61.1
- (no CPE)range: < 7.19.7-1.61.1
- (no CPE)range: < 7.19.7-1.61.1
- (no CPE)range: < 7.37.0-28.1
- (no CPE)range: < 7.19.7-1.61.1
- (no CPE)range: < 7.37.0-28.1
- (no CPE)range: < 7.19.7-1.61.1
- (no CPE)range: < 7.37.0-28.1
- (no CPE)range: < 7.19.7-1.61.1
- (no CPE)range: < 7.19.7-1.61.1
- (no CPE)range: < 7.19.7-1.61.1
- (no CPE)range: < 7.19.7-1.20.42.1
- (no CPE)range: < 7.19.7-1.61.1
- (no CPE)range: < 7.19.7-1.61.1
- (no CPE)range: < 7.19.7-1.61.1
Patches
Vulnerability mechanics
References
18- curl.haxx.se/docs/adv_20160803B.htmlnvdMitigationPatchVendor Advisory
- lists.opensuse.org/opensuse-updates/2016-09/msg00094.htmlnvdThird Party Advisory
- www.debian.org/security/2016/dsa-3638nvdThird Party Advisory
- lists.opensuse.org/opensuse-updates/2016-09/msg00011.htmlnvd
- rhn.redhat.com/errata/RHSA-2016-2575.htmlnvd
- rhn.redhat.com/errata/RHSA-2016-2957.htmlnvd
- www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlnvd
- www.securityfocus.com/bid/92309nvd
- www.securitytracker.com/id/1036537nvd
- www.securitytracker.com/id/1036739nvd
- www.slackware.com/security/viewer.phpnvd
- www.ubuntu.com/usn/USN-3048-1nvd
- access.redhat.com/errata/RHSA-2018:3558nvd
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GLPXQQKURBQFM4XM6645VRPTOE2AWG33/nvd
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3GQH4V3XAQ5Z53AMQRDEC3C3UHTW7QR/nvd
- security.gentoo.org/glsa/201701-47nvd
- source.android.com/security/bulletin/2016-12-01.htmlnvd
- www.tenable.com/security/tns-2016-18nvd
News mentions
0No linked articles in our index yet.