[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fFryogAqSFEZf3rvYW3ojSzr_c1BZ99_v0JRFebJvq_I":3},{"article":4,"iocs":53,"watch_terms":54,"solutions":55,"lesson":87},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"9d2c8041-7d15-4b1e-a200-1ca19148723f","Ubuntu 26.10 Adds New Security Protection to curl, Blocking Revoked SSL Certificates","ubuntu-26-10-adds-new-security-protection-to-curl-blocking-revoked-ssl-certifica-f39ab7","Ubuntu 26.10 Stonking Stingray adds certificate revocation checks to curl, helping the command-line tool reject HTTPS connections that use revoked certificates. Announced on November 10, the change brings upki support into Ubuntu’s curl package. It marks an initial step toward browser-grade certificate checks across the operating system. The protection closes a gap in how applications […] The post Ubuntu 26.10 Adds New Security Protection to curl, Blocking Revoked SSL Certificates appeared first on Cyber Security News.","Ubuntu 26.10 \"Stonking Stingray\" now includes certificate revocation checks for curl, enhancing security by rejecting HTTPS connections that use revoked SSL certificates. This integration utilizes upki-openssl and Mozilla's CRLite technology, allowing curl to check against local revocation data without requiring additional network requests. The feature aims to close a security gap by providing browser-grade certificate checks to applications beyond web browsers.","Ubuntu 26.10 adds certificate revocation checks to curl, blocking connections with revoked SSL certificates.","https:\u002F\u002Fcybersecuritynews.com\u002Fubuntu-26-10-adds-protection-to-curl\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FUbuntu-26.10-Adds-New-Security-Protection-to-curl-Blocking-Revoked-SSL-Certificates-1.webp","2026-11-11T17:18:40+00:00","2026-11-11T18:00:30.246208+00:00",7,[17,20,22,24,26,28],{"name":18,"type":19},"curl","product",{"name":21,"type":19},"OpenSSL",{"name":23,"type":19},"upki",{"name":25,"type":19},"CRLite",{"name":27,"type":19},"Firefox",{"name":29,"type":19},"Chrome","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":30,"icon":32,"name":33,"slug":34},null,"Vulnerabilities","vulnerabilities",[36,41,46,51],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"0493c7e9-989a-4692-b4e6-136f5ec09675","Cryptography","cryptography",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":52},{"id":30,"icon":32,"name":33,"slug":34},[],[18,21,23],{"controls":56,"vendors":86},[57],{"slug":58,"name":59,"problem":60,"products":61},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"utimaco","Utimaco","\u002Fvendor-logos\u002Futimaco.png","utimaco-hsm","Utimaco General Purpose HSM","https:\u002F\u002Futimaco.com\u002Fdata-protection\u002Fgp-hsm","Hardware security modules for key generation, storage and cryptographic operations.",[],{"slug":88,"title":89,"body":90,"framework_refs":91,"framework_notes":97},"ubuntu-closes-ssl-revocation-gap-in-curl-bringing-browser-grade-certificate-checks-to-cli-tools","Ubuntu Closes SSL Revocation Gap in curl, Bringing Browser-Grade Certificate Checks to CLI Tools","For years, curl — one of the most widely used command-line HTTP tools — did not perform certificate revocation checks by default, meaning it would happily accept HTTPS connections using certificates that had been revoked due to compromise or misissuance. This gap left server-side applications, scripts, and automation pipelines exposed to man-in-the-middle attacks involving revoked certificates that browsers would have rejected outright. Ubuntu 26.10 addresses this by integrating Mozilla's CRLite technology and upki-openssl, enabling local revocation checks without extra network overhead. The lesson is that security defaults matter: tools trusted by developers and administrators must enforce the same cryptographic hygiene that end-user browsers do, and OS vendors have a responsibility to ship secure-by-default configurations.",[92,93,94,95,96],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","NIST SP 800-53 SC-17: Public Key Infrastructure Certificates","NIST CSF 2.0 PR.PS-01: Configuration Management","NIS2 Article 21(2)(h)","OWASP A02:2021 Cryptographic Failures",{"NIS2 Article 21(2)(h)":98,"OWASP A02:2021 Cryptographic Failures":99,"NIST CSF 2.0 PR.PS-01: Configuration Management":100,"NIST SP 800-53 SC-17: Public Key Infrastructure Certificates":101,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":102},"NIS2 Article 21(2)(h) requires appropriate use of cryptography and encryption, which encompasses enforcing proper TLS certificate validation including revocation to maintain the integrity of secure communications.","OWASP A02 covers failures in cryptographic implementation, including failure to verify certificate revocation status, which allows attackers to present revoked certificates without detection.","PR.PS-01 asks that configuration management practices ensure secure settings are applied to software, directly covering the need to enable certificate revocation checking in tools like curl.","SC-17 requires organizations to validate certificates in accordance with an established policy, which explicitly includes checking revocation status before trusting a certificate.","CIS Control 4 requires that software be deployed with secure default configurations; curl's historical lack of revocation checking represents a misconfigured default that this control would mandate be corrected."]