{"id":"CURL-CVE-2017-2629","summary":"SSL_VERIFYSTATUS ignored","details":"curl and libcurl support \"OCSP stapling\", also known as the TLS Certificate\nStatus Request extension (using the `CURLOPT_SSL_VERIFYSTATUS` option). When\ntelling curl to use this feature, it uses that TLS extension to ask for a\nfresh proof of the server's certificate's validity. If the server does not\nsupport the extension, or fails to provide said proof, curl is expected to\nreturn an error.\n\nDue to a coding mistake, the code that checks for a test success or failure,\nends up always thinking there is valid proof, even when there is none or if\nthe server does not support the TLS extension in question. Contrary to how it\nused to function and contrary to how this feature is documented to work.\n\nThis could lead to users not detecting when a server's certificate goes\ninvalid or otherwise be mislead that the server is in a better shape than it\nis in reality.\n\nThis flaw also exists in the command line tool\n([--cert-status](https://curl.se/docs/manpage.html#--cert-status)).","aliases":["CVE-2017-2629"],"modified":"2026-04-25T20:38:49.777120Z","published":"2017-02-22T08:00:00Z","database_specific":{"last_affected":"7.52.1","affects":"both","CWE":{"desc":"Missing Critical Step in Authentication","id":"CWE-304"},"URL":"https://curl.se/docs/CVE-2017-2629.json","www":"https://curl.se/docs/CVE-2017-2629.html","package":"curl","severity":"Medium"},"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"7.52.0"},{"fixed":"7.53.0"}]},{"type":"GIT","repo":"https://github.com/curl/curl.git","events":[{"introduced":"cb4e2be7c6d42ca0780f8e0a747cecf9ba45f151"},{"fixed":"ca6ea6d9be5102a2246dff6e17b3ee9ad4ec64d0"}]}],"versions":["7.52.1","7.52.0"],"database_specific":{"vanir_signatures_modified":"2026-04-25T20:38:49Z","source":"https://curl.se/docs/CURL-CVE-2017-2629.json","vanir_signatures":[{"signature_type":"Line","deprecated":false,"source":"https://github.com/curl/curl.git/commit/ca6ea6d9be5102a2246dff6e17b3ee9ad4ec64d0","target":{"file":"lib/url.c"},"id":"CURL-CVE-2017-2629-08b7eec2","digest":{"threshold":0.9,"line_hashes":["160665740063046155517844372076301689042","198891217239531211524141736418754414083","322579211368063099254116412346148995678","79061788277258896117150026689157888690","88032411500943683711438062858328207727"]},"signature_version":"v1"},{"signature_type":"Function","deprecated":false,"source":"https://github.com/curl/curl.git/commit/ca6ea6d9be5102a2246dff6e17b3ee9ad4ec64d0","target":{"file":"lib/url.c","function":"allocate_conn"},"id":"CURL-CVE-2017-2629-92867ef2","digest":{"length":3770,"function_hash":"84407265895070014931195834263246948524"},"signature_version":"v1"}]}}],"schema_version":"1.7.5","credits":[{"name":"Marcus Hoffmann","type":"FINDER"},{"name":"Daniel Stenberg","type":"REMEDIATION_DEVELOPER"}]}