curl libcurl LDAPS Threading Vulnerability TLS Option Interference

A vulnerability exists in curl's libcurl library when handling multi-threaded LDAPS (LDAP over TLS) transfers. In this scenario, modifying TLS options in one thread can unintentionally alter them globally, potentially impacting other concurrent transfers. This issue can lead to unintended consequences, such as disabling certificate verification for one transfer, which could inadvertently affect other threads as well. This vulnerability arises from unsynchronized access to shared data in a multi-threaded context, making it highly timing-sensitive.

Impact

The vulnerability can cause incorrect TLS behavior in multi-threaded LDAPS transfers, leading to potential security risks such as improper certificate verification.

Remediation

Users can upgrade to curl version 8.18.0, build curl with OpenLDAP, or avoid using LDAP altogether.