MEDIUM
The darwinssl_connect_step1 function in lib/vtls/curl_darwinssl.c in libcurl 7.31.0 through 7.39.0, when using the DarwinSSL (aka SecureTransport) back-end for TLS, does not check if a cached TLS session validated the certificate when reusing the session, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
http://curl.haxx.se/docs/adv_20150108A.html
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743
http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
http://secunia.com/advisories/61925
Source: MITRE
Published: 2015-01-15
Updated: 2017-07-01
Type: NVD-CWE-Other
Base Score: 5.8
Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:N)
Impact Score: 4.9
Exploitability Score: 8.6
Severity: MEDIUM