Skip to content
Fencer Intel
medium 4.3

CVE-2017-2629 json

curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificat…

published 2018-07-27 8 y ago modified 2026-06-17 4 mo ago also EUVD-2017-11790

cvss
4.3
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.2%
EPSS 1.2% chance of exploitation in 30 days, percentile 69%
public exploits
0
none known

Summary

curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate's validity in the code that checks for a test success or failure. It ends up always thinking there's valid proof, even when there is none or if the server doesn't support the TLS extension in question. This could lead to users not detecting when a server's certificate goes invalid or otherwise be mislead that the server is in a better shape than it is in reality. This flaw also exists in the command line tool (--cert-status).

Patch / fix

  • haxx curl 7.53.0
  • curl Debian 14, Debian 13, Debian 12 7.52.1-3

debian advisories DEBIAN-CVE-2017-2629

  • curl openSUSE Tumbleweed 7.79.1-1.1

opensuse advisories openSUSE-SU-2024:10582-1

  • curl Alpine 3.24, Alpine 3.23, Alpine 3.22 +12 more 7.53.0-r0
  • curl Alpine 3.11, Alpine 3.8, Alpine 3.7 +1 more 7.53.0
  • curl Alpine 3.3, Alpine 3.2 7.52.1-r1
  • curl Alpine 3.5, Alpine 3.4 7.52.1-r2

alpine advisories ALPINE-CVE-2017-2629

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • curl Arch Linux 7.53.0-1
  • libcurl-compat Arch Linux 7.53.0-1
  • libcurl-gnutls Arch Linux 7.53.0-1
  • lib32-curl Arch Linux 7.53.0-1
  • lib32-libcurl-compat Arch Linux 7.53.0-1
  • lib32-libcurl-gnutls Arch Linux 7.53.0-1

arch linux advisories AVG-179AVG-180AVG-181AVG-182AVG-183AVG-184

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2017-2629 updated cvss 4.3

curl: SSL_VERIFYSTATUS ignored

  • Red Hat .NET Core 1.0 on Red Hat Enterprise Linux rh-dotnetcore10-curl Red Hat .NET Core 1.1 on Red Hat Enterprise Linux rh-dotnetcore11-curl Red Hat .NET Core 2.0 on Red Hat Enterprise Linux rh-dotnet20-curl Red Hat Enterprise Linux 5 curl Red Hat Enterprise Linux 6 curl, libcurl Red Hat Enterprise Linux 7 curl, libcurl
    +3 more products
    Red Hat Enterprise Virtualization 3 mingw-virt-viewer, mingw32-virt-viewer, mingw64-virt-viewer Red Hat JBoss Web Server 3 curl Red Hat Software Collections httpd24-curl, httpd24-libcurl
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.23% chance of exploitation in the next 30 days, higher than 69% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.0 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
NVD 3.0 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
NVD 2.0 4.0 AV:N/AC:L/Au:S/C:N/I:P/A:N

Affected products

  • CURL curl

Classification

Weakness
  • CWE-295 Improper Certificate Validation

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.