When CURLOPT_PINNEDPUBLICKEY is configured alongside options that disable
standard peer verification (CURLOPT_SSL_VERIFYPEER = 0 and
CURLOPT_SSL_VERIFYHOST = 0), libcurl fails to enforce public key pinning on
connections established without a presented server certificate. Bypassing the
pinning check under these disabled-verification conditions allows
unauthenticated connections to succeed when they should be rejected.
Weakness
The product does not validate, or incorrectly validates, a certificate.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Curl | Haxx | 7.45.0 (including) | 8.22.0 (excluding) |
| Red Hat Hardened Images | RedHat | curl-main-8.22.0-0.1.hum1 | * |
| Curl | Ubuntu | devel | * |
| Curl | Ubuntu | esm-infra-legacy/xenial | * |
| Curl | Ubuntu | esm-infra/bionic | * |
| Curl | Ubuntu | esm-infra/focal | * |
| Curl | Ubuntu | jammy | * |
| Curl | Ubuntu | noble | * |
| Curl | Ubuntu | resolute | * |
| Curl | Ubuntu | upstream | * |