CVE catalog
CVE-2017-7468
curl: CVE-2017-7468
- Severity
- High · CVSS 7.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 1.65% · Oct 25, 2026
In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which was established by the previous certificate (or no certificate). libcurl supports by default the use of TLS session id/ticket to resume previous TLS sessions to speed up subsequent TLS handshakes. They are used when for any reason an existing TLS connection couldn't be kept alive to make the next handshake faster. This flaw is a regression and identical to CVE-2016-5419 reported on August 3rd 2016, but affecting a different version range.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | curl | sid | 8.23.0-1 | fixed |
| Debian | curl | forky | 8.22.0-1 | fixed |
| Debian | curl | trixie | 8.14.1-2+deb13u5 | fixed |
| Debian | curl | trixie-security | 8.14.1-2+deb13u7 | fixed |
| Debian | curl | bookworm | 7.88.1-10+deb12u15 | fixed |
| Debian | curl | bookworm-security | 7.88.1-10+deb12u5 | fixed |
| Alpine | curl | 3.10 | 7.54.0-r0 | fixed |
| Alpine | curl | 3.11 | 7.54.0-r0 | fixed |
| Alpine | curl | 3.12 | 7.54.0-r0 | fixed |
| Alpine | curl | 3.13 | 7.54.0-r0 | fixed |
| Alpine | curl | 3.14 | 7.54.0-r0 | fixed |
| Alpine | curl | 3.15 | 7.54.0-r0 | fixed |
| Alpine | curl | 3.16 | 7.54.0-r0 | fixed |
| Alpine | curl | 3.17 | 7.54.0-r0 | fixed |
| Alpine | curl | 3.18 | 7.54.0-r0 | fixed |
| Alpine | curl | 3.19 | 7.54.0-r0 | fixed |
| Alpine | curl | 3.2 | 7.52.1-r1 | fixed |
| Alpine | curl | 3.20 | 7.54.0-r0 | fixed |
| Alpine | curl | 3.21 | 7.54.0-r0 | fixed |
| Alpine | curl | 3.22 | 7.54.0-r0 | fixed |
| Alpine | curl | 3.23 | 7.54.0-r0 | fixed |
| Alpine | curl | 3.24 | 7.54.0-r0 | fixed |
| Alpine | curl | 3.3 | 7.52.1-r1 | fixed |
| Alpine | curl | 3.4 | 7.52.1-r2 | fixed |
| Alpine | curl | 3.5 | 7.52.1-r3 | fixed |
| Alpine | curl | 3.6 | 7.54.0-r0 | fixed |
| Alpine | curl | 3.7 | 7.54.0-r0 | fixed |
| Alpine | curl | 3.8 | 7.54.0-r0 | fixed |
| Alpine | curl | 3.9 | 7.54.0-r0 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | curl | source | sid | 7.52.1-5 | not yet assigned | Not reported | Not reported |
| Debian | curl | source | forky | 7.52.1-5 | not yet assigned | Not reported | Not reported |
| Debian | curl | source | trixie | 7.52.1-5 | not yet assigned | Not reported | Not reported |
| Debian | curl | source | bookworm | 7.52.1-5 | not yet assigned | Not reported | Not reported |
| Alpine | curl | apk | 3.10 | 7.54.0-r0 | Not reported | ALPINE-CVE-2017-7468 | Not reported |
| Alpine | curl | apk | 3.11 | 7.54.0-r0 | Not reported | ALPINE-CVE-2017-7468 | Not reported |
| Alpine | curl | apk | 3.12 | 7.54.0-r0 | Not reported | ALPINE-CVE-2017-7468 | Not reported |
| Alpine | curl | apk | 3.13 | 7.54.0-r0 | Not reported | ALPINE-CVE-2017-7468 | Not reported |
| Alpine | curl | apk | 3.14 | 7.54.0-r0 | Not reported | ALPINE-CVE-2017-7468 | Not reported |
| Alpine | curl | apk | 3.15 | 7.54.0-r0 | Not reported | ALPINE-CVE-2017-7468 | Not reported |
| Alpine | curl | apk | 3.16 | 7.54.0-r0 | Not reported | ALPINE-CVE-2017-7468 | Not reported |
| Alpine | curl | apk | 3.17 | 7.54.0-r0 | Not reported | ALPINE-CVE-2017-7468 | Not reported |
| Alpine | curl | apk | 3.18 | 7.54.0-r0 | Not reported | ALPINE-CVE-2017-7468 | Not reported |
| Alpine | curl | apk | 3.19 | 7.54.0-r0 | Not reported | ALPINE-CVE-2017-7468 | Not reported |
| Alpine | curl | apk | 3.2 | 7.52.1-r1 | Not reported | ALPINE-CVE-2017-7468 | Not reported |
| Alpine | curl | apk | 3.20 | 7.54.0-r0 | Not reported | ALPINE-CVE-2017-7468 | Not reported |
| Alpine | curl | apk | 3.21 | 7.54.0-r0 | Not reported | ALPINE-CVE-2017-7468 | Not reported |
| Alpine | curl | apk | 3.22 | 7.54.0-r0 | Not reported | ALPINE-CVE-2017-7468 | Not reported |
| Alpine | curl | apk | 3.23 | 7.54.0-r0 | Not reported | ALPINE-CVE-2017-7468 | Not reported |
| Alpine | curl | apk | 3.24 | 7.54.0-r0 | Not reported | ALPINE-CVE-2017-7468 | Not reported |
| Alpine | curl | apk | 3.3 | 7.52.1-r1 | Not reported | ALPINE-CVE-2017-7468 | Not reported |
| Alpine | curl | apk | 3.4 | 7.52.1-r2 | Not reported | ALPINE-CVE-2017-7468 | Not reported |
| Alpine | curl | apk | 3.5 | 7.52.1-r3 | Not reported | ALPINE-CVE-2017-7468 | Not reported |
| Alpine | curl | apk | 3.6 | 7.54.0-r0 | Not reported | ALPINE-CVE-2017-7468 | Not reported |
| Alpine | curl | apk | 3.7 | 7.54.0-r0 | Not reported | ALPINE-CVE-2017-7468 | Not reported |
| Alpine | curl | apk | 3.8 | 7.54.0-r0 | Not reported | ALPINE-CVE-2017-7468 | Not reported |
| Alpine | curl | apk | 3.9 | 7.54.0-r0 | Not reported | ALPINE-CVE-2017-7468 | Not reported |
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
[Debian 12 (Bookworm)]
- [curl]Unknown
Details (6)
7.88.1-10+deb12u15· amd64 · bookwormFixed · Fixed:
7.52.1-5dsa · curl · debian · bookworm; dsa · curl · debian · 12
7.88.1-10+deb12u15· arm64 · bookwormFixed · Fixed:
7.52.1-5dsa · curl · debian · bookworm; dsa · curl · debian · 12
8.14.1-2+deb13u2~bpo13+1· amd64 · bookworm-backportsFixed · Fixed:
7.52.1-5dsa · curl · debian · bookworm; dsa · curl · debian · 12
8.14.1-2+deb13u2~bpo13+1· arm64 · bookworm-backportsFixed · Fixed:
7.52.1-5dsa · curl · debian · bookworm; dsa · curl · debian · 12
7.88.1-10+deb12u5· amd64 · bookworm-securityFixed · Fixed:
7.52.1-5dsa · curl · debian · bookworm; dsa · curl · debian · 12
7.88.1-10+deb12u5· arm64 · bookworm-securityFixed · Fixed:
7.52.1-5dsa · curl · debian · bookworm; dsa · curl · debian · 12
- [libcurl3-gnutls]Unknown
Source package: [curl]
Details (6)
7.88.1-10+deb12u15· amd64 · bookwormFixed · Fixed:
7.52.1-5dsa · curl · debian · bookworm; dsa · curl · debian · 12
7.88.1-10+deb12u15· arm64 · bookwormFixed · Fixed:
7.52.1-5dsa · curl · debian · bookworm; dsa · curl · debian · 12
8.14.1-2+deb13u2~bpo13+1· amd64 · bookworm-backportsFixed · Fixed:
7.52.1-5dsa · curl · debian · bookworm; dsa · curl · debian · 12
8.14.1-2+deb13u2~bpo13+1· arm64 · bookworm-backportsFixed · Fixed:
7.52.1-5dsa · curl · debian · bookworm; dsa · curl · debian · 12
7.88.1-10+deb12u5· amd64 · bookworm-securityFixed · Fixed:
7.52.1-5dsa · curl · debian · bookworm; dsa · curl · debian · 12
7.88.1-10+deb12u5· arm64 · bookworm-securityFixed · Fixed:
7.52.1-5dsa · curl · debian · bookworm; dsa · curl · debian · 12
- [libcurl3-nss]Unknown
Source package: [curl]
Details (4)
7.88.1-10+deb12u15· amd64 · bookwormFixed · Fixed:
7.52.1-5dsa · curl · debian · bookworm; dsa · curl · debian · 12
7.88.1-10+deb12u15· arm64 · bookwormFixed · Fixed:
7.52.1-5dsa · curl · debian · bookworm; dsa · curl · debian · 12
7.88.1-10+deb12u5· amd64 · bookworm-securityFixed · Fixed:
7.52.1-5dsa · curl · debian · bookworm; dsa · curl · debian · 12
7.88.1-10+deb12u5· arm64 · bookworm-securityFixed · Fixed:
7.52.1-5dsa · curl · debian · bookworm; dsa · curl · debian · 12
- [libcurl4]Unknown
Source package: [curl]
Details (6)
7.88.1-10+deb12u15· amd64 · bookwormFixed · Fixed:
7.52.1-5dsa · curl · debian · bookworm; dsa · curl · debian · 12
7.88.1-10+deb12u15· arm64 · bookwormFixed · Fixed:
7.52.1-5dsa · curl · debian · bookworm; dsa · curl · debian · 12
8.14.1-2+deb13u2~bpo13+1· amd64 · bookworm-backportsFixed · Fixed:
7.52.1-5dsa · curl · debian · bookworm; dsa · curl · debian · 12
8.14.1-2+deb13u2~bpo13+1· arm64 · bookworm-backportsFixed · Fixed:
7.52.1-5dsa · curl · debian · bookworm; dsa · curl · debian · 12
7.88.1-10+deb12u5· amd64 · bookworm-securityFixed · Fixed:
7.52.1-5dsa · curl · debian · bookworm; dsa · curl · debian · 12
7.88.1-10+deb12u5· arm64 · bookworm-securityFixed · Fixed:
7.52.1-5dsa · curl · debian · bookworm; dsa · curl · debian · 12
- [libcurl4-doc]Unknown
Source package: [curl]
Details (6)
7.88.1-10+deb12u15· all · bookwormFixed · Fixed:
7.52.1-5dsa · curl · debian · bookworm; dsa · curl · debian · 12
7.88.1-10+deb12u15· all · bookwormFixed · Fixed:
7.52.1-5dsa · curl · debian · bookworm; dsa · curl · debian · 12
8.14.1-2+deb13u2~bpo13+1· all · bookworm-backportsFixed · Fixed:
7.52.1-5dsa · curl · debian · bookworm; dsa · curl · debian · 12
8.14.1-2+deb13u2~bpo13+1· all · bookworm-backportsFixed · Fixed:
7.52.1-5dsa · curl · debian · bookworm; dsa · curl · debian · 12
7.88.1-10+deb12u5· all · bookworm-securityFixed · Fixed:
7.52.1-5dsa · curl · debian · bookworm; dsa · curl · debian · 12
7.88.1-10+deb12u5· all · bookworm-securityFixed · Fixed:
7.52.1-5dsa · curl · debian · bookworm; dsa · curl · debian · 12
- [libcurl4-gnutls-dev]Unknown
Source package: [curl]
Details (6)
7.88.1-10+deb12u15· amd64 · bookwormFixed · Fixed:
7.52.1-5dsa · curl · debian · bookworm; dsa · curl · debian · 12
7.88.1-10+deb12u15· arm64 · bookwormFixed · Fixed:
7.52.1-5dsa · curl · debian · bookworm; dsa · curl · debian · 12
8.14.1-2+deb13u2~bpo13+1· amd64 · bookworm-backportsFixed · Fixed:
7.52.1-5dsa · curl · debian · bookworm; dsa · curl · debian · 12
8.14.1-2+deb13u2~bpo13+1· arm64 · bookworm-backportsFixed · Fixed:
7.52.1-5dsa · curl · debian · bookworm; dsa · curl · debian · 12
7.88.1-10+deb12u5· amd64 · bookworm-securityFixed · Fixed:
7.52.1-5dsa · curl · debian · bookworm; dsa · curl · debian · 12
7.88.1-10+deb12u5· arm64 · bookworm-securityFixed · Fixed:
7.52.1-5dsa · curl · debian · bookworm; dsa · curl · debian · 12
- [libcurl4-nss-dev]Unknown
Source package: [curl]
Details (4)
7.88.1-10+deb12u15· amd64 · bookwormFixed · Fixed:
7.52.1-5dsa · curl · debian · bookworm; dsa · curl · debian · 12
7.88.1-10+deb12u15· arm64 · bookwormFixed · Fixed:
7.52.1-5dsa · curl · debian · bookworm; dsa · curl · debian · 12
7.88.1-10+deb12u5· amd64 · bookworm-securityFixed · Fixed:
7.52.1-5dsa · curl · debian · bookworm; dsa · curl · debian · 12
7.88.1-10+deb12u5· arm64 · bookworm-securityFixed · Fixed:
7.52.1-5dsa · curl · debian · bookworm; dsa · curl · debian · 12
- [libcurl4-openssl-dev]Unknown
Source package: [curl]
Details (6)
7.88.1-10+deb12u15· amd64 · bookwormFixed · Fixed:
7.52.1-5dsa · curl · debian · bookworm; dsa · curl · debian · 12
7.88.1-10+deb12u15· arm64 · bookwormFixed · Fixed:
7.52.1-5dsa · curl · debian · bookworm; dsa · curl · debian · 12
8.14.1-2+deb13u2~bpo13+1· amd64 · bookworm-backportsFixed · Fixed:
7.52.1-5dsa · curl · debian · bookworm; dsa · curl · debian · 12
8.14.1-2+deb13u2~bpo13+1· arm64 · bookworm-backportsFixed · Fixed:
7.52.1-5dsa · curl · debian · bookworm; dsa · curl · debian · 12
7.88.1-10+deb12u5· amd64 · bookworm-securityFixed · Fixed:
7.52.1-5dsa · curl · debian · bookworm; dsa · curl · debian · 12
7.88.1-10+deb12u5· arm64 · bookworm-securityFixed · Fixed:
7.52.1-5dsa · curl · debian · bookworm; dsa · curl · debian · 12
[Debian 13 (Trixie)]
- [curl]Unknown
Details (5)
8.14.1-2+deb13u4· amd64 · trixieFixed · Fixed:
7.52.1-5dsa · curl · debian · 13
8.14.1-2+deb13u4· arm64 · trixieFixed · Fixed:
7.52.1-5dsa · curl · debian · 13
8.21.0-2~bpo13+1· amd64 · trixie-backportsFixed · Fixed:
7.52.1-5dsa · curl · debian · 13
8.21.0-2~bpo13+1· arm64 · trixie-backportsFixed · Fixed:
7.52.1-5dsa · curl · debian · 13
8.14.1-2+deb13u7· amd64 · trixie-securityFixed · Fixed:
7.52.1-5dsa · curl · debian · 13
- [libcurl3t64-gnutls]Unknown
Source package: [curl]
Details (5)
8.14.1-2+deb13u4· amd64 · trixieFixed · Fixed:
7.52.1-5dsa · curl · debian · 13
8.14.1-2+deb13u4· arm64 · trixieFixed · Fixed:
7.52.1-5dsa · curl · debian · 13
8.21.0-2~bpo13+1· amd64 · trixie-backportsFixed · Fixed:
7.52.1-5dsa · curl · debian · 13
8.21.0-2~bpo13+1· arm64 · trixie-backportsFixed · Fixed:
7.52.1-5dsa · curl · debian · 13
8.14.1-2+deb13u7· amd64 · trixie-securityFixed · Fixed:
7.52.1-5dsa · curl · debian · 13
- [libcurl4-doc]Unknown
Source package: [curl]
Details (5)
8.14.1-2+deb13u4· all · trixieFixed · Fixed:
7.52.1-5dsa · curl · debian · 13
8.14.1-2+deb13u4· all · trixieFixed · Fixed:
7.52.1-5dsa · curl · debian · 13
8.21.0-2~bpo13+1· all · trixie-backportsFixed · Fixed:
7.52.1-5dsa · curl · debian · 13
8.21.0-2~bpo13+1· all · trixie-backportsFixed · Fixed:
7.52.1-5dsa · curl · debian · 13
8.14.1-2+deb13u7· all · trixie-securityFixed · Fixed:
7.52.1-5dsa · curl · debian · 13
- [libcurl4-gnutls]Unknown
Source package: [curl]
Details (2)
8.21.0-2~bpo13+1· amd64 · trixie-backportsFixed · Fixed:
7.52.1-5dsa · curl · debian · 13
8.21.0-2~bpo13+1· arm64 · trixie-backportsFixed · Fixed:
7.52.1-5dsa · curl · debian · 13
- [libcurl4-gnutls-dev]Unknown
Source package: [curl]
Details (5)
8.14.1-2+deb13u4· amd64 · trixieFixed · Fixed:
7.52.1-5dsa · curl · debian · 13
8.14.1-2+deb13u4· arm64 · trixieFixed · Fixed:
7.52.1-5dsa · curl · debian · 13
8.21.0-2~bpo13+1· amd64 · trixie-backportsFixed · Fixed:
7.52.1-5dsa · curl · debian · 13
8.21.0-2~bpo13+1· arm64 · trixie-backportsFixed · Fixed:
7.52.1-5dsa · curl · debian · 13
8.14.1-2+deb13u7· amd64 · trixie-securityFixed · Fixed:
7.52.1-5dsa · curl · debian · 13
- [libcurl4-openssl-dev]Unknown
Source package: [curl]
Details (5)
8.14.1-2+deb13u4· amd64 · trixieFixed · Fixed:
7.52.1-5dsa · curl · debian · 13
8.14.1-2+deb13u4· arm64 · trixieFixed · Fixed:
7.52.1-5dsa · curl · debian · 13
8.21.0-2~bpo13+1· amd64 · trixie-backportsFixed · Fixed:
7.52.1-5dsa · curl · debian · 13
8.21.0-2~bpo13+1· arm64 · trixie-backportsFixed · Fixed:
7.52.1-5dsa · curl · debian · 13
8.14.1-2+deb13u7· amd64 · trixie-securityFixed · Fixed:
7.52.1-5dsa · curl · debian · 13
- [libcurl4t64]Unknown
Source package: [curl]
Details (5)
8.14.1-2+deb13u4· amd64 · trixieFixed · Fixed:
7.52.1-5dsa · curl · debian · 13
8.14.1-2+deb13u4· arm64 · trixieFixed · Fixed:
7.52.1-5dsa · curl · debian · 13
8.21.0-2~bpo13+1· amd64 · trixie-backportsFixed · Fixed:
7.52.1-5dsa · curl · debian · 13
8.21.0-2~bpo13+1· arm64 · trixie-backportsFixed · Fixed:
7.52.1-5dsa · curl · debian · 13
8.14.1-2+deb13u7· amd64 · trixie-securityFixed · Fixed:
7.52.1-5dsa · curl · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_10582-1.json]
- [https://osv.dev/vulnerability/ALPINE-CVE-2017-7468]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2017-7468]
- [https://security-tracker.debian.org/tracker/CVE-2017-7468]
- [https://security.access.redhat.com/data/csaf/v2/vex/2017/cve-2017-7468.json]
[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]