cURL TLS 1.3 session ticket proxy host mixup Vulnerability
About this episode
Enabled by default, libcurl supports the use of TLS 1.3 session tickets to resume previous TLS sessions to speed up subsequent TLS handshakes.
When using a HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived from the remote server and then wrongly "short-cut" the host handshake. The reason for this confusion is the modified sequence from TLS 1.2 when the session ids would provided only during the TLS handshake, while in TLS 1.3 it happens post hand-shake and the code was not updated to take that changed behavior into account.
4:00 http connect
Get every episode summarized
Each time The Backend Engineering Show with Hussein Nasser publishes, we email you a written briefing from the transcript — the topics, who appeared, and any specific claims, with the ad reads skipped.
Email me new episodesFree for 3 shows. No card needed.
Hosts & guests
No transcript yet
This episode has not been transcribed. Request it and it moves to the front of the queue.
More episodes
More from The Backend Engineering Show with Hussein Nasser
Caching is a cop-out
The Backend Engineering Show with Hussein Nasser
How open ai agents "hacked" hugging face
The Backend Engineering Show with Hussein Nasser
How a query optimization gave birth to infinite scroll
The Backend Engineering Show with Hussein Nasser
Postgres is half as fast in Linux 7.0
The Backend Engineering Show with Hussein Nasser