CVE-2017-2628

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

curl, as shipped in Red Hat Enterprise Linux 6 before version 7.19.7-53, did not correctly backport the fix for CVE-2015-3148 because it did not reflect the fact that the HAVE_GSSAPI define was meanwhile substituted by USE_HTTP_NEGOTIATE. This issue was introduced in RHEL 6.7 and affects RHEL 6 curl only.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
Red Hat, Inc.	curl	7.19.7-53

References

http://rhn.redhat.com/errata/RHSA-2017-0847.htmlThird Party Advisory
http://www.securityfocus.com/bid/97187Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1422464Issue Tracking
http://rhn.redhat.com/errata/RHSA-2017-0847.htmlThird Party Advisory
http://www.securityfocus.com/bid/97187Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1422464Issue Tracking

Timeline

Published: Mar 12, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-26296.5curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate CVE-2017-26308.8A stack buffer overflow flaw was found in the Quick Emulator (QEMU) before 2.9 built with the Network Block Device (NBD) client support. The CVE-2017-26324.9A logic error in valid_role() in CloudForms role validation before 5.7.1.3 could allow a tenant administrator to create groups with a higher CVE-2017-26336.5An out-of-bounds memory access issue was found in Quick Emulator (QEMU) before 1.7.2 in the VNC display driver. This flaw could occur while CVE-2017-26347.5It was found that the Linux kernel's Datagram Congestion Control Protocol (DCCP) implementation before 2.6.22.17 used the IPv4-only inet_sk_CVE-2017-26356.5A NULL pointer deference flaw was found in the way libvirt from 2.5.0 to 3.0.0 handled empty drives. A remote authenticated attacker could u CVE-2017-26367.0Race condition in drivers/tty/n_hdlc.c in the Linux kernel through 4.10.1 allows local users to gain privileges or cause a denial of service CVE-2017-263710.0A design flaw issue was found in the Red Hat OpenStack Platform director use of TripleO to enable libvirtd based live-migration. Libvirtd is CVE-2017-26386.5It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. An attacker could use this vuln CVE-2017-26397.5It was found that CloudForms does not verify that the server hostname matches the domain name in the certificate when using a custom CA and CVE-2017-26409.8An out-of-bounds write flaw was found in the way Pidgin before 2.12.0 processed XML content. A malicious remote server could potentially use CVE-2017-26419.8In Moodle 2.x and 3.x, SQL injection can occur via user preferences.