CVE-2017-2629

Vulnerability

A coding mistake in curl and libcurl's TLS Certificate Status Request (OCSP stapling) feature, introduced in version 7.52.0 and present up to 7.52.1, causes the certificate validity check to always succeed, even when the server does not support the extension or fails to provide a valid proof of certificate status [1][4]. This affects the CURLOPT_SSL_VERIFYSTATUS option and the --cert-status command-line flag [1]. The bug was introduced during a code merge for HTTPS proxy support and lacked automated tests [1].

Exploitation

An attacker with a man-in-the-middle network position can exploit this vulnerability by presenting a revoked or otherwise invalid TLS certificate to a client using the affected curl versions. Because the client never properly validates the OCSP response, the attack will succeed without triggering an error [1]. The attacker only needs to intercept the TLS handshake and omit or supply a fake OCSP stapling response; the client will incorrectly treat it as valid [4].

Impact

Successful exploitation allows the attacker to impersonate any TLS server without detection, undermining the integrity and authenticity of secure communications. Users may be misled into believing a server's certificate is valid when it is not, potentially leading to data interception or manipulation [1][4].

Mitigation

The vulnerability is fixed in curl version 7.53.0, released on February 22, 2017 [1]. Users should upgrade to curl 7.53.0 or later, and applications using libcurl should be rebuilt with the fixed library [3]. There is no known workaround [3]. Affected versions: curl 7.52.0 to 7.52.1 inclusive; versions prior to 7.52.0 are not affected [1][4].