CVE-2017-2629: curl Improper Certificate Validation
Vulnerability summary
CVE-2017-2629 is a medium (CVSS 6.5) Improper Certificate Validation vulnerability in curl. EPSS estimates a 1.23% chance of exploitation in the next 30 days, higher than 68.7% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 27-07-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate's validity in the code that checks for a test success or failure. It ends up always thinking there's valid proof, even when there is none or if the server doesn't support the TLS extension in question. This could lead to users not detecting when a server's certificate goes invalid or otherwise be mislead that the server is in a better shape than it is in reality. This flaw also exists in the command line tool (--cert-status).
CVSS metrics
5 scores · 4 sources · 2 versions- CVE.orgCNA4.3MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NDiffers
- OSV · AlpineEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
EPSS trend
Probability
1.23%
Chance of exploitation in the next 30 days
Percentile
69%
Versus all other CVEs
30-day change
-0.09 pp
From 1.32% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Alpine1 product
- curl< 7.53.0-r0 | < 7.53.0 | < 7.52.1-r1 | < 7.52.1-r2
Curl1 product
- curl7.53.0
Debian1 product
- curl< 7.52.1-3
Haxx1 product
- curl< 7.53.0
4 vendors · 4 products
References
8 links- bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2629X Refsource CONFIRMIssue TrackingPatchThird Party Advisory
