Fatfree Core
Monthly
Improper TLS certificate validation in fatfree-core through 3.9.2 leaves outbound HTTPS requests made through the framework's HTTP client open to man-in-the-middle attacks. The flaw hard-disables CURLOPT_SSL_VERIFYPEER in web.php's _curl function, but exploitation is difficult: it requires the application to use this client for outbound HTTPS and an attacker to hold an active MITM position, and impact is limited to data transmitted through that client. The vendor released 3.9.3 with commit a2c755c, and no public exploit code or active exploitation is reported; this is a medium-severity, low-urgency issue rather than an emergency.
Improper TLS certificate validation in fatfree-core through 3.9.2 leaves outbound HTTPS requests made through the framework's HTTP client open to man-in-the-middle attacks. The flaw hard-disables CURLOPT_SSL_VERIFYPEER in web.php's _curl function, but exploitation is difficult: it requires the application to use this client for outbound HTTPS and an attacker to hold an active MITM position, and impact is limited to data transmitted through that client. The vendor released 3.9.3 with commit a2c755c, and no public exploit code or active exploitation is reported; this is a medium-severity, low-urgency issue rather than an emergency.