Описание
A vulnerability exists where a new transfer that uses STARTTLS to upgrade the
connection might reuse an existing live connection even though the TLS
configuration mismatches so it should not.
A flaw was found in curl. When a new data transfer attempts to upgrade its connection using STARTTLS, it may incorrectly reuse an existing live connection. This reuse can occur even if the Transport Layer Security (TLS) configuration of the new transfer does not match the existing connection, potentially leading to an insecure connection being established.
Отчет
This is an Important flaw as curl may establish an insecure connection when attempting to upgrade a transfer with STARTTLS, potentially reusing an existing connection with mismatched TLS configurations. This could lead to unexpected data exposure or compromise, particularly in environments where curl is used for sensitive data transfers and relies on STARTTLS for security.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | curl | Affected | ||
| Red Hat Enterprise Linux 7 | curl | Affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Affected | ||
| Red Hat Trusted Profile Analyzer | rhtpa/rhtpa-trustification-service-rhel9 | Not affected | ||
| Red Hat Enterprise Linux 10 | curl | Fixed | RHSA-2026:55450 | 17.08.2026 |
| Red Hat Enterprise Linux 8 | curl | Fixed | RHSA-2026:57462 | 20.08.2026 |
| Red Hat Enterprise Linux 9 | curl | Fixed | RHSA-2026:55439 | 17.08.2026 |
| Red Hat Enterprise Linux 9 | curl | Fixed | RHSA-2026:55439 | 17.08.2026 |
| Red Hat JBoss Core Services 2.4.62.SP5 | Fixed | RHSA-2026:56869 | 19.08.2026 | |
| Red Hat OpenShift Container Platform 4.22 | rhcos-4.22.9.8.202608251819 | Fixed | RHSA-2026:60440 | 01.09.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
8.1 High
CVSS3
Связанные уязвимости
A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.
A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.
A vulnerability exists where a new transfer that uses STARTTLS to upgr ...
EPSS
8.1 High
CVSS3