Description
With the wolfSSL backend, when CA caching is enabled and an `CURLOPT_SSL_CTX_FUNCTION` callback replaces the trust store, libcurl can silently reinstall the cached store after the callback returns. A certificate trusted by the cached store but rejected by the callback-selected store is then incorrectly accepted.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
curl curl
Default version status: unaffected
8.9.1 to < 8.14.2affected8.15.0 to < 8.16.1affected8.17.0 to < 8.20.1affected8.21.0 to < 8.22.0affected
curl curl
Default version status: unaffected
0f2876b2c33f6784a27b6f7345bd8cd95b46352a to < ed0338befd1d865a8ea1fbaa90013a096dedd07aaffected
curl curl
Default version status: unaffected
8.21.0affected8.20.0affected8.19.0affected8.18.0affected8.17.0affected8.16.0affected8.15.0affected8.14.1affected8.14.0affected8.13.0affected8.12.1affected8.12.0affected8.11.1affected8.11.0affected8.10.1affected8.10.0affected8.9.1affected