Scientific Linux SL7.x SLSA-2016:2575-2 Moderate: Curl Auth Hijack Alert

Date: Wed, 14 Dec 2016 18:17:05 -0000
Reply-To: scientific-linux-users@
Sender: Security Errata for Scientific Linux
 
From: Scott Reid 
Subject: Security ERRATA Moderate: curl on SL7.x x86_64
MIME-Version: 1.0
Message-ID: <20161214181705.3201.59994@slpackages.fnal.gov>

Synopsis: Moderate: curl security, bug fix, and enhancement update
Advisory ID: SLSA-2016:2575-2
Issue Date: 2016-11-03
CVE Numbers: CVE-2016-5419
 CVE-2016-5420
 CVE-2016-7141
--

Security Fix(es):

* It was found that the libcurl library did not prevent TLS session
resumption when the client certificate had changed. An attacker could
potentially use this flaw to hijack the authentication of the connection
by leveraging a previously created connection with a different client
certificate. (CVE-2016-5419)

* It was found that the libcurl library did not check the client
certificate when choosing the TLS connection to reuse. An attacker could
potentially use this flaw to hijack the authentication of the connection
by leveraging a previously created connection with a different client
certificate. (CVE-2016-5420)

* It was found that the libcurl library using the NSS (Network Security
Services) library as TLS/SSL backend incorrectly re-used client
certificates for subsequent TLS connections in certain cases. An attacker
could potentially use this flaw to hijack the authentication of the
connection by leveraging a previously created connection with a different
client certificate. (CVE-2016-7141)

Additional Changes:
--

SL7
 x86_64
 curl-7.29.0-35.el7.x86_64.rpm
 curl-debuginfo-7.29.0-35.el7.i686.rpm
 curl-debuginfo-7.29.0-35.el7.x86_64.rpm
 libcurl-7.29.0-35.el7.i686.rpm
 libcurl-7.29.0-35.el7.x86_64.rpm
 libcurl-devel-7.29.0-35.el7.i686.rpm
 libcurl-devel-7.29.0-35.el7.x86_64.rpm

- Scientific Linux Development Team