CVE-2025-14017: broken TLS options for threaded LDAPS
broken TLS options for threaded LDAPS
Other sources
When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrently setup transfers.
Disabling certificate verification for a specific transfer could unintentionally disable the feature for other threads as well.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14017?
The severity of CVE-2025-14017 is considered moderate due to potential security risks from altered TLS options affecting multiple transfers.
How do I fix CVE-2025-14017?
To fix CVE-2025-14017, update to the latest version of libcurl where the vulnerability is patched.
What are the potential impacts of CVE-2025-14017?
The potential impacts of CVE-2025-14017 include compromised security through unintended changes in TLS settings during concurrent LDAPS transfers.
Which software is affected by CVE-2025-14017?
CVE-2025-14017 affects the libcurl library, specifically the Red Hat distribution of libcurl.
Can CVE-2025-14017 affect the confidentiality of data?
Yes, CVE-2025-14017 can affect the confidentiality of data by allowing unauthorized changes to TLS security protocols during transfers.