CVE-2014-8151

CVE-2014-8151 affects libcurl’s DarwinSSL (SecureTransport) back-end. The darwinssl_connect_step1 function fails to verify whether a cached TLS session validated the certificate when the session is reused, enabling MITM-style server spoofing via crafted certificates. Documented impact is limited ...