cURL TLS 1.3 session ticket proxy host mixup Vulnerability

episode

The Backend Engineering Show with Hussein Nasser not yet transcribed

▲ 0

Transcript

This episode hasn't been transcribed yet Upvotes decide what gets transcribed next — 0 so far. Sign in to upvote

Related

recent transcribed audio

Trump Makes MAJOR Move as Midterms Get Closer | Guests: Donald & Amy Johnson | 9/29/26 2h 6m · 29 Sep 2026 · The Glenn Beck Program

Best of the Program | Guests: Donald & Amy Johnson | 9/29/26 43 min · 29 Sep 2026 · The Glenn Beck Program

Standoff At Drumcree Enters Third Day 16 min · 29 Sep 2026 · The Last Word with Matt Cooper

The Last Word On Music: Oasis Sell Out Live ’27 Tour In Staggered Three Day Sale 18 min · 29 Sep 2026 · The Last Word with Matt Cooper

The 3 Senate Seats Republicans Can ACTUALLY Flip 1h 2m · 29 Sep 2026 · Next Up with Mark Halperin

Trump Miscalculates as Canada’s PM Carney Plans for US Invasion 16 min · 29 Sep 2026 · Legal AF by MeidasTouch

Report any issue

Source

Recorded31 Mar 2021

Publisheranchor.fm ↗

Handlerec:9885948

Show notes

Enabled by default, libcurl supports the use of TLS 1.3 session tickets to resume previous TLS sessions to speed up subsequent TLS handshakes. When using a HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived from the remote server and then wrongly "short-cut" the host handshake. The reason for this confusion is the modified sequence from TLS 1.2 when the session ids would provided only during the TLS handshake, while in TLS 1.3 it happens post hand-shake and the code was not updated to take that changed behavior into account. 4:00 http connect https://curl.se/docs/CVE-2021-22890.html

Ask this episode

“What did the council decide on item 42?” — answered with the speaker and the moment.

Sign in