libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary depending on used file systems.The comparison also didn't include the 'issuer cert' which a transfer can setto qualify how to verify the server certificate.

Affected Software

CPE Name Name Version
haxx:libcurl haxx libcurl 7.77.0
fedoraproject:fedora fedoraproject fedora 33
debian:debian_linux debian debian linux 9.0
debian:debian_linux debian debian linux 10.0
debian:debian_linux debian debian linux 11.0
netapp:cloud_backup netapp cloud backup -
netapp:clustered_data_ontap netapp clustered data ontap -
netapp:solidfire_\&_hci_management_node netapp solidfire \& hci management node -
netapp:solidfire_baseboard_management_controller_firmware netapp solidfire baseboard management controller firmware -
oracle:peoplesoft_enterprise_peopletools oracle peoplesoft enterprise peopletools 8.57
oracle:peoplesoft_enterprise_peopletools oracle peoplesoft enterprise peopletools 8.58
oracle:peoplesoft_enterprise_peopletools oracle peoplesoft enterprise peopletools 8.59
oracle:mysql_server oracle mysql server 8.0.26
oracle:mysql_server oracle mysql server 5.7.36
siemens:sinec_infrastructure_network_services siemens sinec infrastructure network services
siemens:sinema_remote_connect_server siemens sinema remote connect server 3.1
siemens:logo\!_cmr2040_firmware siemens logo\! cmr2040 firmware *
siemens:logo\!_cmr2020_firmware siemens logo\! cmr2020 firmware *
siemens:ruggedcomrm_1224_lte_firmware siemens ruggedcomrm 1224 lte firmware 7.1
siemens:scalance_m804pb_firmware siemens scalance m804pb firmware 7.1
siemens:scalance_m812-1_firmware siemens scalance m812-1 firmware 7.1
siemens:scalance_m816-1_firmware siemens scalance m816-1 firmware 7.1
siemens:scalance_m826-2_firmware siemens scalance m826-2 firmware 7.1
siemens:scalance_m874-2_firmware siemens scalance m874-2 firmware 7.1
siemens:scalance_m874-3_firmware siemens scalance m874-3 firmware 7.1
siemens:scalance_m876-3_firmware siemens scalance m876-3 firmware 7.1
siemens:scalance_m876-4_firmware siemens scalance m876-4 firmware 7.1
siemens:scalance_mum856-1_firmware siemens scalance mum856-1 firmware 7.1
siemens:scalance_s615_firmware siemens scalance s615 firmware 7.1
siemens:simatic_cp_1543-1_firmware siemens simatic cp 1543-1 firmware 3.0.22
siemens:simatic_cp_1545-1_firmware siemens simatic cp 1545-1 firmware 1.1
siemens:simatic_rtu3010c_firmware siemens simatic rtu3010c firmware 5.0.14
siemens:simatic_rtu3030c_firmware siemens simatic rtu3030c firmware 5.0.14
siemens:simatic_rtu3031c_firmware siemens simatic rtu3031c firmware 5.0.14
siemens:simatic_rtu_3041c_firmware siemens simatic rtu 3041c firmware 5.0.14
siemens:sinema_remote_connect siemens sinema remote connect 3.1
siemens:siplus_net_cp_1543-1_firmware siemens siplus net cp 1543-1 firmware 3.0.22