Description
A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
curl curl
Default version status: unaffected
7.82.0 to < 8.14.2affected8.15.0 to < 8.16.1affected8.17.0 to < 8.20.1affected8.21.0 to < 8.22.0affected
curl curl
Default version status: unaffected
eeca818b1e8d1e61c2d4d833aed56ce4c510a9d4 to < ea71c3b6b60e563651ea8596a975aef0c8199519affected
curl curl
Default version status: unaffected
8.21.0affected8.20.0affected8.19.0affected8.18.0affected8.17.0affected8.16.0affected8.15.0affected8.14.1affected8.14.0affected8.13.0affected8.12.1affected8.12.0affected8.11.1affected8.11.0affected8.10.1affected8.10.0affected8.9.1affected8.9.0affected8.8.0affected8.7.1affected8.7.0affected8.6.0affected8.5.0affected8.4.0affected8.3.0affected8.2.1affected8.2.0affected8.1.2affected8.1.1affected8.1.0affected8.0.1affected8.0.0affected7.88.1affected7.88.0affected7.87.0affected7.86.0affected7.85.0affected7.84.0affected7.83.1affected7.83.0affected7.82.0affected