CyberRota Analysis
AI-GeneratedThe vulnerability affects applications using the wolfSSL backend in libcurl when CA caching is enabled and a custom trust store is implemented via the `CURLOPT_SSL_CTX_FUNCTION` callback. This flaw allows libcurl to erroneously accept certificates that are trusted by the cached store but rejected by the newly selected trust store, potentially leading to man-in-the-middle attacks. Developers and organizations utilizing libcurl with wolfSSL should prioritize addressing this issue to ensure proper certificate validation and maintain secure communications.
Original NVD Description
With the wolfSSL backend, when CA caching is enabled and an `CURLOPT_SSL_CTX_FUNCTION` callback replaces the trust store, libcurl can silently reinstall the cached store after the callback returns. A certificate trusted by the cached store but rejected by the callback-selected store is then incorrectly accepted.
Related CVEs
Other vulnerabilities affecting the same vendor(s)