CVE-2016-5419 in macOS

Summary

curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, which allows remote attackers to bypass intended restrictions by resuming a session.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Reservation

06/10/2016

Disclosure

08/10/2016

Status

Confirmed

Entries

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerability	CWE	Exp	Cou	CVE
94363	Apple macOS curl cryptographic issue	310	Not defined	Official fix	CVE-2016-5419
90448	cURL/libcURL TLS Session Resumption Client Certificate cryptographic issue	310	Not defined	Official fix	CVE-2016-5419

Sources

• MITRE
• NVD
• CVE Details