Published: 23/11/2013 Updated: 17/06/2016

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

cURL and libcurl 7.18.0 up to and including 7.32.0, when built with OpenSSL, disables the certificate CN and SAN name field verification (CURLOPT_SSL_VERIFYHOST) when the digital signature verification (CURLOPT_SSL_VERIFYPEER) is disabled, which allows man-in-the-middle malicious users to spoof SSL servers via an arbitrary valid certificate.

Vulnerable Product	Search on Vulmon	Subscribe to Product
haxx curl 7.32.0
haxx curl 7.18.2
haxx curl 7.18.1
haxx curl 7.19.5
haxx curl 7.19.2
haxx curl 7.21.5
haxx curl 7.21.2
haxx curl 7.25.0
haxx curl 7.26.0
haxx curl 7.19.0
haxx curl 7.19.6
haxx curl 7.20.1
haxx curl 7.21.6
haxx curl 7.21.1
haxx curl 7.22.0
haxx curl 7.28.0
haxx curl 7.29.0
haxx curl 7.31.0
haxx curl 7.19.7
haxx curl 7.19.4
haxx curl 7.21.7
haxx curl 7.21.4
haxx curl 7.23.0
haxx curl 7.23.1
haxx curl 7.24.0
haxx curl 7.30.0
haxx curl 7.18.0
haxx curl 7.19.1
haxx curl 7.19.3
haxx curl 7.20.0
haxx curl 7.21.3
haxx curl 7.21.0
haxx curl 7.27.0
haxx curl 7.28.1
haxx libcurl 7.31.0
haxx libcurl 7.32.0
haxx libcurl 7.19.3
haxx libcurl 7.19.4
haxx libcurl 7.21.2
haxx libcurl 7.21.3
haxx libcurl 7.23.1
haxx libcurl 7.24.0
haxx libcurl 7.30.0
haxx libcurl 7.18.2
haxx libcurl 7.19.0
haxx libcurl 7.19.7
haxx libcurl 7.20.0
haxx libcurl 7.21.6
haxx libcurl 7.21.7
haxx libcurl 7.27.0
haxx libcurl 7.28.0
haxx libcurl 7.19.1
haxx libcurl 7.19.2
haxx libcurl 7.20.1
haxx libcurl 7.21.0
haxx libcurl 7.21.1
haxx libcurl 7.22.0
haxx libcurl 7.23.0
haxx libcurl 7.28.1
haxx libcurl 7.29.0
haxx libcurl 7.18.0
haxx libcurl 7.18.1
haxx libcurl 7.19.5
haxx libcurl 7.19.6
haxx libcurl 7.21.4
haxx libcurl 7.21.5
haxx libcurl 7.25.0
haxx libcurl 7.26.0

Fraudulent security certificates could allow sensitive information to be exposed when accessing the Internet ...

Scott Cantor discovered that curl, a file retrieval tool, would disable the CURLOPT_SSLVERIFYHOST check when the CURLOPT_SSL_VERIFYPEER setting was disabled This would also disable ssl certificate host name checks when it should have only disabled verification of the certificate trust chain The default configuration for the curl package is not af ...

CWE-310 http://curl.haxx.se/docs/adv_20131115.html http://www.debian.org/security/2013/dsa-2798 http://lists.opensuse.org/opensuse-updates/2013-12/msg00053.html http://lists.opensuse.org/opensuse-updates/2013-12/msg00047.html http://www.ubuntu.com/usn/USN-2048-1 http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04463322 http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html https://usn.ubuntu.com/2048-1/https://nvd.nist.gov

CVE-2013-4545

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect