CVE-2017-2628 — curl: negotiate not treated as connection-oriented (incomplete fix for CVE-2015-3148)

Back Back to CVE browser

CRITICAL

curl: negotiate not treated as connection-oriented (incomplete fix for CVE-2015-3148)

Published Mar 12, 2018

9.8

CRITICAL

CVSS 3.0

EPSS 3.80%

Description

curl, as shipped in Red Hat Enterprise Linux 6 before version 7.19.7-53, did not correctly backport the fix for CVE-2015-3148 because it did not reflect the fact that the HAVE_GSSAPI define was meanwhile substituted by USE_HTTP_NEGOTIATE. This issue was introduced in RHEL 6.7 and affects RHEL 6 curl only.

Affected products

Vendor Red Hat, Inc. Product Curl Default
n/a
- Version
  7.19.7-53
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Red Hat, Inc.

Curl

n/a

Version	Status	Constraints
7.19.7-53	affected	-

Red Hat Enterprise Linux 6

curl-0:7.19.7-53.el6_9

Fixed · RHSA-2017:0847
Red Hat Ceph Storage 2

curl

Not affected
Red Hat Enterprise Linux 5

curl

Not affected
Red Hat Enterprise Linux 7

curl

Not affected
Red Hat Enterprise Virtualization 3

mingw-virt-viewer

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 6	curl-0:7.19.7-53.el6_9	Fixed	RHSA-2017:0847
Red Hat Ceph Storage 2	curl	Not affected	n/a
Red Hat Enterprise Linux 5	curl	Not affected	n/a
Red Hat Enterprise Linux 7	curl	Not affected	n/a
Red Hat Enterprise Virtualization 3	mingw-virt-viewer	Not affected	n/a

Remediation

No remediation recorded yet.

Metrics

3.80% 0.03796

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.03796

Score over time

2021–2026

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (21 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	3.80% (0.03796)	89.65th	v5 (v2026.06.15)
Jun 15, 2026	4.01% (0.04010)	89.19th	v5 (v2026.06.15)
Mar 30, 2025	1.04% (0.01042)	75.46th	v4 (v2025.03.14)
Mar 29, 2025	3.71% (0.03711)	79.68th	v4 (v2025.03.14)
Jul 20, 2024	0.37% (0.00370)	72.87th	v3 (v2023.03.01)
Feb 20, 2024	0.37% (0.00370)	71.88th	v3 (v2023.03.01)
Dec 26, 2023	0.53% (0.00525)	74.40th	v3 (v2023.03.01)
Sep 12, 2023	0.63% (0.00625)	76.35th	v3 (v2023.03.01)
Aug 3, 2023	0.59% (0.00592)	75.49th	v3 (v2023.03.01)
Apr 10, 2023	1.06% (0.01056)	81.82th	v3 (v2023.03.01)
Mar 7, 2023	0.76% (0.00764)	78.34th	v3 (v2023.03.01)
Mar 6, 2023	0.95% (0.00954)	36.37th	v2 (v2022.01.01)
Feb 13, 2023	0.95% (0.00954)	35.90th	v2 (v2022.01.01)
Feb 3, 2023	1.02% (0.01018)	39.95th	v2 (v2022.01.01)
Sep 2, 2022	0.95% (0.00954)	34.50th	v2 (v2022.01.01)
Apr 1, 2022	0.95% (0.00954)	32.50th	v2 (v2022.01.01)
Feb 4, 2022	0.95% (0.00954)	16.28th	v2 (v2022.01.01)
Feb 3, 2022	0.83% (0.00833)	24.58th	v1
Jan 6, 2022	0.83% (0.00833)	23.96th	v1
Sep 1, 2021	0.83% (0.00833)	57.50th	v1
Apr 14, 2021	0.83% (0.00833)	0.00th	v1

Weaknesses (1)

CWE-287

Improper Authentication

References (6)

http://rhn.redhat.com/errata/RHSA-2017-0847.html
vendor-advisoryx_refsource_REDHATThird Party Advisory
http://www.securityfocus.com/bid/97187
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://access.redhat.com/security/cve/CVE-2017-2628
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1422464
x_refsource_CONFIRMIssue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2017-2628
https://www.cve.org/CVERecord?id=CVE-2017-2628

Link	Providers	Tags
http://rhn.redhat.com/errata/RHSA-2017-0847.html		vendor-advisoryx_refsource_REDHATThird Party Advisory
http://www.securityfocus.com/bid/97187		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://access.redhat.com/security/cve/CVE-2017-2628		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1422464		x_refsource_CONFIRMIssue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2017-2628
https://www.cve.org/CVERecord?id=CVE-2017-2628