CVE-2017-2629
curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks...
curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate's validity in the code that checks for a test success or failure. It ends up always thinking there's valid proof, even when there is none or if the server doesn't support the TLS extension in question. This could lead to users not detecting when a server's certificate goes invalid or otherwise be mislead that the server is in a better shape than it is in reality. This flaw also exists in the command line tool (--cert-status).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate's validity in the code that checks for a test success or failure. It ends up always thinking there's valid proof, even when there is none or if the server doesn't support the TLS extension in question. This could lead to users not detecting when a server's certificate goes invalid or otherwise be mislead that the server is in a better shape than it is in reality. This flaw also exists in the command line tool (--cert-status).
- Record
CVE-2017-2629- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
EUVDEUVD-2017-11790
curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate's validity in the code that checks for a test success or failure. It ends up always thinking there's valid proof, even when there is none or if the server doesn't support the TLS extension in question. This could lead to users not detecting when a server's certificate goes invalid or otherwise be mislead that the server is in a better shape than it is in reality. This flaw also exists in the command line tool (--cert-status).
- Record
EUVD-2017-11790- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7cp4-w7q7-w394
curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks...
curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate's validity in the code that checks for a test success or failure. It ends up always thinking there's valid proof, even when there is none or if the server doesn't support the TLS extension in question. This could lead to users not detecting when a server's certificate goes invalid or otherwise be mislead that the server is in a better shape than it is in reality. This flaw also exists in the command line tool (--cert-status).
- Record
GHSA-7cp4-w7q7-w394- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
NVD
curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate's validity in the code that checks for a test success or failure. It ends up always thinking there's valid proof, even when there is none or if the server doesn't support the TLS extension in question. This could lead to users not detecting when a server's certificate goes invalid or otherwise be mislead that the server is in a better shape than it is in reality. This flaw also exists in the command line tool (--cert-status).
- Record
CVE-2017-2629- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:N/I:P/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
OSVALPINE-CVE-2017-2629
curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate's validity in the code that checks for a test success or failure. It ends up always thinking there's valid proof, even when there is none or if the server doesn't support the TLS extension in question. This could lead to users not detecting when a server's certificate goes invalid or otherwise be mislead that the server is in a better shape than it is in reality. This flaw also exists in the command line tool (--cert-status).
- Record
ALPINE-CVE-2017-2629- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVBELL-CVE-2017-2629
CVE-2017-2629 does not affect BellSoft software
- Record
BELL-CVE-2017-2629- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSV
curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate's validity in the code that checks for a test success or failure. It ends up always thinking there's valid proof, even when there is none or if the server doesn't support the TLS extension in question. This could lead to users not detecting when a server's certificate goes invalid or otherwise be mislead that the server is in a better shape than it is in reality. This flaw also exists in the command line tool (--cert-status).
- Record
CVE-2017-2629- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-2629
curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate's validity in the code that checks for a test success or failure. It ends up always thinking there's valid proof, even when there is none or if the server doesn't support the TLS extension in question. This could lead to users not detecting when a server's certificate goes invalid or otherwise be mislead that the server is in a better shape than it is in reality. This flaw also exists in the command line tool (--cert-status).
- Record
DEBIAN-CVE-2017-2629- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVCURL-CVE-2017-2629 No score
SSL_VERIFYSTATUS ignored
curl and libcurl support "OCSP stapling", also known as the TLS Certificate
Status Request extension (using the CURLOPT_SSL_VERIFYSTATUS option). When
telling curl to use this feature, it uses that TLS extension to ask for a
fresh proof of the server's certificate's validity. If the server does not
support the extension, or fails to provide said proof, curl is expected to
return an error.
Due to a coding mistake, the code that checks for a test success or failure, ends up always thinking there is valid proof, even when there is none or if the server does not support the TLS extension in question. Contrary to how it used to function and contrary to how this feature is documented to work.
This could lead to users not detecting when a server's certificate goes invalid or otherwise be mislead that the server is in a better shape than it is in reality.
This flaw also exists in the command line tool (--cert-status).
- Record
CURL-CVE-2017-2629- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10582-1 No score
curl-7.79.1-1.1 on GA media
These are all security issues fixed in the curl-7.79.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10582-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
curlAlpine:v3.10 |
before 7.53.0-r0 | 7.53.0-r0 |
curlAlpine:v3.11 |
before 7.53.0 | 7.53.0 |
curlAlpine:v3.12 |
before 7.53.0-r0 | 7.53.0-r0 |
curlAlpine:v3.13 |
before 7.53.0-r0 | 7.53.0-r0 |
curlAlpine:v3.14 |
before 7.53.0-r0 | 7.53.0-r0 |
curlAlpine:v3.15 |
before 7.53.0-r0 | 7.53.0-r0 |
curlAlpine:v3.16 |
before 7.53.0-r0 | 7.53.0-r0 |
curlAlpine:v3.17 |
before 7.53.0-r0 | 7.53.0-r0 |
curlAlpine:v3.18 |
before 7.53.0-r0 | 7.53.0-r0 |
curlAlpine:v3.19 |
before 7.53.0-r0 | 7.53.0-r0 |
Show 17 moreShow less
| Package | Affected | Fixed |
|---|---|---|
curlAlpine:v3.2 |
before 7.52.1-r1 | 7.52.1-r1 |
curlAlpine:v3.20 |
before 7.53.0-r0 | 7.53.0-r0 |
curlAlpine:v3.21 |
before 7.53.0-r0 | 7.53.0-r0 |
curlAlpine:v3.22 |
before 7.53.0-r0 | 7.53.0-r0 |
curlAlpine:v3.23 |
before 7.53.0-r0 | 7.53.0-r0 |
curlAlpine:v3.24 |
before 7.53.0-r0 | 7.53.0-r0 |
curlAlpine:v3.3 |
before 7.52.1-r1 | 7.52.1-r1 |
curlAlpine:v3.4 |
before 7.52.1-r2 | 7.52.1-r2 |
curlAlpine:v3.5 |
before 7.52.1-r2 | 7.52.1-r2 |
curlAlpine:v3.6 |
before 7.53.0 | 7.53.0 |
curlAlpine:v3.7 |
before 7.53.0 | 7.53.0 |
curlAlpine:v3.8 |
before 7.53.0 | 7.53.0 |
curlAlpine:v3.9 |
before 7.53.0-r0 | 7.53.0-r0 |
curlDebian:12 |
before 7.52.1-3 | 7.52.1-3 |
curlDebian:13 |
before 7.52.1-3 | 7.52.1-3 |
curlDebian:14 |
before 7.52.1-3 | 7.52.1-3 |
curlopenSUSE:Tumbleweed From an advisory covering 48 CVEs |
before 7.79.1-1.1 | 7.79.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-2629 is a medium vulnerability (CVSS 4.3) in Curl, published February 22, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.23%, the 69th percentile. Fixed in curl 7.53.0-r0.
References
securityfocus.com/bid/96382
bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2629
securitytracker.com/id/1037871
tenable.com/security/tns-2017-09
curl.haxx.se/docs/adv_20170222.html
security.gentoo.org/glsa/201703-04
Show 53 moreShow less
nvd.nist.gov/vuln/detail/CVE-2017-2629
github.com/advisories/GHSA-7cp4-w7q7-w394
security.alpinelinux.org/vuln/CVE-2017-2629
docs.bell-sw.com/security/cves/CVE-2017-2629
security-tracker.debian.org/tracker/CVE-2017-2629
suse.com/security/cve/CVE-2006-1061