CyberRota Analysis
AI-GeneratedThe vulnerability arises in libcurl when `CURLOPT_PINNEDPUBLICKEY` is used in conjunction with disabled peer verification options, allowing unauthenticated connections to bypass public key pinning checks. This could lead to potential man-in-the-middle attacks, as connections that should be rejected may succeed without proper certificate validation. Organizations using libcurl in security-sensitive applications should prioritize addressing this issue to ensure robust connection security.
Original NVD Description
When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.
Related CVEs
Other vulnerabilities affecting the same vendor(s)