curl: FTP too eager connection reuse

A flaw was found in the Curl package. Libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, several FTP settings were left out from the configuration match checks, making them match too easily. The problematic...

CVE-2023-27535: Authentication Bypass by Primary Weakness

An authentication bypass vulnerability exists in libcurl 8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers. Previously created connections are kept in a connection pool for reuse if they match the current setup. However, certain...

curl: CVE-2023-27535: FTP too eager connection reuse

A vulnerability existed in libcurl FTPS protocol that allowed the reuse of a connection even if different credentials were specified for different connections, resulting in the use of cached credentials for the wrong content. The vulnerability was caused by the failure to refuse caching when...