Vulnerability identifier: #VU55146
Vulnerability risk: Medium
Exploitation vector: Network
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to errors in the logic when the config matching function does not take "issuer cert" into account and it compares the involved paths case insensitively. A remote attacker can gain access to sensitive information on the system.
Install updates from vendor's website.
Vulnerable software versions
cURL: 7.10.4 - 7.78.0
Fixed software versions
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?