Description (CNA)
An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP control connection that a previous easy handle upgraded with `STARTTLS` and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new FTP login, so the server continues to authorize it under the first handle's certificate identity.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| curl / curl | affected 8.21.0 through 8.21.0 |
CWE
No CWE identifiers supplied.