Description
libcurl 7.14.0 through 7.16.3, when built with GnuTLS support, does not check SSL/TLS certificate expiration or activation dates, which allows remote attackers to bypass certain access restrictions.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | curl | 7.16.4-1 | — |
| Debian 13 | curl | 7.16.4-1 | — |
| Debian 12 | curl | 7.16.4-1 | — |
| Debian 4.0 | curl | 7.15.5-1etch1 | DSA-1333-1 |
Advisories 1
- DSA-1333-1 curl Debian Security (DSA / DLA) · Mar 9, 2026
References
- 26231 third-party-advisory
- ADV-2007-2551 vdb-entry
- 26128 third-party-advisory
- 26108 third-party-advisory
- 24938 vdb-entry
- 2007-0023 vendor-advisory
- 26104 third-party-advisory
- USN-484-1 vendor-advisory
- libcurl-gnutls-weak-security(35479) vdb-entry
- http://www.curl.haxx.se/docs/adv_20070710.html
- DSA-1333 vendor-advisory