CVE-2021-22890

CVE-2021-22890 affects curl 7.63.0 through 7.75.0. When using TLS 1.3 with an HTTPS proxy, libcurl could confuse TLS session tickets from the proxy as if they came from the remote server, potentially causing the host’s session ticket to be resumed incorrectly and bypass server certificate checks,...

Debian DSA-4881-1 : curl - security update

Multiple vulnerabilities were discovered in cURL, an URL transfer library : - CVE-2020-8169 Marek Szlagor reported that libcurl could be tricked into prepending a part of the password to the host name before it resolves it, potentially leaking the partial password over the network and to the DNS...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : curl vulnerabilities (USN-4898-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4898-1 advisory. Viktor Szakats discovered that curl did not strip off user credentials from referrer header fields. A remote attacker could...

CVE-2021-22890

A flaw was found in the way libcurl handled TLS 1.3 session tickets. A malicious HTTPS proxy could possibly use this flaw to make libcurl resume a TLS session it previously had with the proxy while intending to resume a TLS session with a target server, making it possible for the proxy to perform...

[SECURITY] [DSA 4881-1] curl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4881-1 [email protected] https://www.debian.org/security/ Alessandro Ghedini March 30, 2021 https://www.debian.org/security/faq -...

CURL-CVE-2021-22890 TLS 1.3 session ticket proxy host mix-up

Enabled by default, libcurl supports the use of TLS 1.3 session tickets to resume previous TLS sessions to speed up subsequent TLS handshakes. When using an HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived from the remote serve...

TLS 1.3 session ticket proxy host mix-up

Enabled by default, libcurl supports the use of TLS 1.3 session tickets to resume previous TLS sessions to speed up subsequent TLS handshakes. When using an HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived from the remote serve...

CVE-2021-22890

curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets. When using a HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived...

UBUNTU-CVE-2021-22890

curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets. When using a HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived...

GHSA-5PHF-PP7P-VC2R Using default SSLContext for HTTPS requests in an HTTPS proxy doesn't verify certificate hostname for proxy connection

Impact Users who are using an HTTPS proxy to issue HTTPS requests and haven't configured their own SSLContext via proxyconfig. Only the default SSLContext is impacted. Patches urllib3 =1.26.4 has the issue resolved. urllib31.26 is not impacted due to not supporting HTTPS requests via HTTPS proxie...

curl: CVE-2021-22890: TLS 1.3 session ticket proxy host mixup

Summary: I don't think that this can be easily exploitable, but I am submitting it as a security issue for precaution. I am not looking for a bounty. Commit 549310e907e82e44c59548351d4c6ac4aaada114 enables session resumption with TLS 1.3. Curl connections maintain two SSL contexts, one for the...

PT-2021-5820 · Curl +5 · Curl +5

Name of the Vulnerable Software and Affected Versions: curl versions 7.63.0 through 7.75.0 Description: The issue is related to the incorrect handling of TLS 1.3 session tickets, which can allow a malicious HTTPS proxy to perform a man-in-the-middle MITM attack. When using an HTTPS proxy and TLS...

CVE-2021-28363

The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy if an SSLContext isn't given via proxyconfig doesn't verify the hostname of the certificate. This means certificates for...

CVE-2021-28363

The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy if an SSLContext isn't given via proxyconfig doesn't verify the hostname of the certificate. This means certificates for...

PT-2021-17850

Name of the Vulnerable Software and Affected Versions: urllib3 versions 1.26.x through 1.26.3 Description: The issue concerns the omission of SSL certificate validation in certain cases involving HTTPS to HTTPS proxies. Specifically, when an SSLContext is not provided via proxy config, the initia...

CVE-2021-28363

The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy if an SSLContext isn't given via proxyconfig doesn't verify the hostname of the certificate. This means certificates for...

GHSA-QRG3-F6H6-VQ8Q Denial of Service in https-proxy-agent

Withdrawn: Duplicate of GHSA-8g7p-74h8-hg48...

Denial of Service in https-proxy-agent

Withdrawn: Duplicate of GHSA-8g7p-74h8-hg48...

HTTP/HTTPS proxy support on NetScaler based on Traffic Policies Secure Web

This article describes how to configure NetScaler to proxy the traffic from MDX apps through a Proxy server like Squid, Bluecoat. Enterprises can proxy traffic configuring simple traffic rules on NetScaler box...

@01/service-core (1.2.1), @adyen/api-library (>=2.0.0, <=2.1.5) +349 more potentially affected by unknown CVE via https-proxy-agent (>=2.0.0, <=2.2.2)

https-proxy-agent NPM version =2.0.0, =2.0.0, =3.9.0-alpha.0, =0.1.0, =0.1.0, =2.0.3, =2.1.3 - @back4app/ant 0.0.19 - @back4app/ant-cli 0.0.19 - @back4app/ant-core 0.0.19 - @back4app/ant-graphql 0.0.19 - @back4app/ant-graphql-express 0.0.19 - @back4app/ant-serverless 0.0.19 and more Source cves:...