Every CVESearch/Get API key

CVE-2017-2628

curl, as shipped in Red Hat Enterprise Linux 6 before version 7.19.7-53, did not correctly...

9.8 CriticalFix available

CVE-2017-2628 is a critical vulnerability (CVSS 9.8) in Curl, published March 12, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.80%, the 90th percentile. Fixed in curl 0:7.19.7-53.el6_9.

What does this mean?
Severity
9.8 CriticalCVSS 3.0, NVD
Exploit chance
3.80%EPSS, 90th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
0:7.19.7-53.el6_9curl +15 more

Description

curl, as shipped in Red Hat Enterprise Linux 6 before version 7.19.7-53, did not correctly backport the fix for CVE-2015-3148 because it did not reflect the fact that the HAVE_GSSAPI define was meanwhile substituted by USE_HTTP_NEGOTIATE. This issue was introduced in RHEL 6.7 and affects RHEL 6 curl only.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

3.80%Up 3.0 points since Apr 14, 2021
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
curl
Red Hat:enterprise_linux:6::client
before 0:7.19.7-53.el6_9
0:7.19.7-53.el6_9
curl-debuginfo
Red Hat:enterprise_linux:6::client
before 0:7.19.7-53.el6_9
0:7.19.7-53.el6_9
libcurl
Red Hat:enterprise_linux:6::client
before 0:7.19.7-53.el6_9
0:7.19.7-53.el6_9
libcurl-devel
Red Hat:enterprise_linux:6::client
before 0:7.19.7-53.el6_9
0:7.19.7-53.el6_9
curl
Red Hat:enterprise_linux:6::computenode
before 0:7.19.7-53.el6_9
0:7.19.7-53.el6_9
curl-debuginfo
Red Hat:enterprise_linux:6::computenode
before 0:7.19.7-53.el6_9
0:7.19.7-53.el6_9
libcurl
Red Hat:enterprise_linux:6::computenode
before 0:7.19.7-53.el6_9
0:7.19.7-53.el6_9
libcurl-devel
Red Hat:enterprise_linux:6::computenode
before 0:7.19.7-53.el6_9
0:7.19.7-53.el6_9
curl
Red Hat:enterprise_linux:6::server
before 0:7.19.7-53.el6_9
0:7.19.7-53.el6_9
curl-debuginfo
Red Hat:enterprise_linux:6::server
before 0:7.19.7-53.el6_9
0:7.19.7-53.el6_9
Show 6 moreShow less
Affected packages
PackageAffectedFixed
libcurl
Red Hat:enterprise_linux:6::server
before 0:7.19.7-53.el6_9
0:7.19.7-53.el6_9
libcurl-devel
Red Hat:enterprise_linux:6::server
before 0:7.19.7-53.el6_9
0:7.19.7-53.el6_9
curl
Red Hat:enterprise_linux:6::workstation
before 0:7.19.7-53.el6_9
0:7.19.7-53.el6_9
curl-debuginfo
Red Hat:enterprise_linux:6::workstation
before 0:7.19.7-53.el6_9
0:7.19.7-53.el6_9
libcurl
Red Hat:enterprise_linux:6::workstation
before 0:7.19.7-53.el6_9
0:7.19.7-53.el6_9
libcurl-devel
Red Hat:enterprise_linux:6::workstation
before 0:7.19.7-53.el6_9
0:7.19.7-53.el6_9

What each source reports

NVD Score used9.8

curl, as shipped in Red Hat Enterprise Linux 6 before version 7.19.7-53, did not correctly backport the fix for CVE-2015-3148 because it did not reflect the fact that the HAVE_GSSAPI define was meanwhile substituted by USE_HTTP_NEGOTIATE. This issue was introduced in RHEL 6.7 and affects RHEL 6 curl only.

Record
CVE-2017-2628
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-287
Updated
2026-11-02
CVE ListNo score

curl, as shipped in Red Hat Enterprise Linux 6 before version 7.19.7-53, did not correctly backport the fix for CVE-2015-3148 because it did not reflect the fact that the HAVE_GSSAPI define was meanwhile substituted by USE_HTTP_NEGOTIATE. This issue was introduced in RHEL 6.7 and affects RHEL 6 curl only.

Record
CVE-2017-2628
Weakness
CWE-287
Updated
2026-11-02
EUVDEUVD-2017-11789No score

curl, as shipped in Red Hat Enterprise Linux 6 before version 7.19.7-53, did not correctly backport the fix for CVE-2015-3148 because it did not reflect the fact that the HAVE_GSSAPI define was meanwhile substituted by USE_HTTP_NEGOTIATE. This issue was introduced in RHEL 6.7 and affects RHEL 6 curl only.

Record
EUVD-2017-11789
Updated
2026-11-03
GitHub AdvisoriesGHSA-9v4c-xqrp-4vv99.8

curl, as shipped in Red Hat Enterprise Linux 6 before version 7.19.7-53, did not correctly...

curl, as shipped in Red Hat Enterprise Linux 6 before version 7.19.7-53, did not correctly backport the fix for CVE-2015-3148 because it did not reflect the fact that the HAVE_GSSAPI define was meanwhile substituted by USE_HTTP_NEGOTIATE. This issue was introduced in RHEL 6.7 and affects RHEL 6 curl only.

Record
GHSA-9v4c-xqrp-4vv9
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-287
Updated
2026-11-02
OSV9.8

curl, as shipped in Red Hat Enterprise Linux 6 before version 7.19.7-53, did not correctly backport the fix for CVE-2015-3148 because it did not reflect the fact that the HAVE_GSSAPI define was meanwhile substituted by USE_HTTP_NEGOTIATE. This issue was introduced in RHEL 6.7 and affects RHEL 6 curl only.

Record
CVE-2017-2628
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2017:08474.8

Red Hat Security Advisory: curl security update

Record
RHSA-2017:0847
CVSS 3.0
4.8 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-13

History

History
RecordedChangedSources
facts
aliases, productsEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 4 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open