[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fbsFMuLKIUnw3JCbwQUaZno8-nmFRRJKT9k_VdvxRD98":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"7fdff6f9-b2dd-4195-a1c1-f8ad0399453d","ubuntu-closes-ssl-revocation-gap-in-curl-bringing-browser-grade-certificate-checks-to-cli-tools","9d2c8041-7d15-4b1e-a200-1ca19148723f","Ubuntu Closes SSL Revocation Gap in curl, Bringing Browser-Grade Certificate Checks to CLI Tools","For years, curl — one of the most widely used command-line HTTP tools — did not perform certificate revocation checks by default, meaning it would happily accept HTTPS connections using certificates that had been revoked due to compromise or misissuance. This gap left server-side applications, scripts, and automation pipelines exposed to man-in-the-middle attacks involving revoked certificates that browsers would have rejected outright. Ubuntu 26.10 addresses this by integrating Mozilla's CRLite technology and upki-openssl, enabling local revocation checks without extra network overhead. The lesson is that security defaults matter: tools trusted by developers and administrators must enforce the same cryptographic hygiene that end-user browsers do, and OS vendors have a responsibility to ship secure-by-default configurations.","**Immediate actions:**\n- Audit all scripts and applications using curl or similar HTTP libraries to confirm they enforce certificate validation, including revocation checks.\n- Upgrade to Ubuntu 26.10 or apply equivalent revocation-check configurations on other platforms where curl is used in production.\n\n**Long-term improvements:**\n- Establish a baseline security configuration standard for all HTTP client tools that mandates certificate validation and revocation checking.\n- Include TLS configuration review (certificate validation flags, pinning, revocation) in application security assessments and code reviews.\n- Track OS and library security hardening releases as part of your patch management cycle, not just CVE-driven patches.\n\n**Detection measures:**\n- Monitor outbound HTTPS connections from automated systems for use of certificates with anomalous issuance or expiry patterns that may indicate revoked or misissumed certs.\n- Include TLS hygiene checks (revocation, chain validation) in infrastructure compliance scans.",[12,13,14,15,16],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","NIST SP 800-53 SC-17: Public Key Infrastructure Certificates","NIST CSF 2.0 PR.PS-01: Configuration Management","NIS2 Article 21(2)(h)","OWASP A02:2021 Cryptographic Failures",{"NIS2 Article 21(2)(h)":18,"OWASP A02:2021 Cryptographic Failures":19,"NIST CSF 2.0 PR.PS-01: Configuration Management":20,"NIST SP 800-53 SC-17: Public Key Infrastructure Certificates":21,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":22},"NIS2 Article 21(2)(h) requires appropriate use of cryptography and encryption, which encompasses enforcing proper TLS certificate validation including revocation to maintain the integrity of secure communications.","OWASP A02 covers failures in cryptographic implementation, including failure to verify certificate revocation status, which allows attackers to present revoked certificates without detection.","PR.PS-01 asks that configuration management practices ensure secure settings are applied to software, directly covering the need to enable certificate revocation checking in tools like curl.","SC-17 requires organizations to validate certificates in accordance with an established policy, which explicitly includes checking revocation status before trusting a certificate.","CIS Control 4 requires that software be deployed with secure default configurations; curl's historical lack of revocation checking represents a misconfigured default that this control would mandate be corrected.","published","2026-11-11T18:20:25.189858+00:00","2026-11-11T18:20:25.132+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fcybersecuritynews.com\u002Fubuntu-26-10-adds-protection-to-curl\u002F","ubuntu-26-10-adds-new-security-protection-to-curl-blocking-revoked-ssl-certifica-f39ab7","Ubuntu 26.10 Adds New Security Protection to curl, Blocking Revoked SSL Certificates",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[],[45],{"slug":46,"name":47,"problem":48},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control."]