cURL and libcurl 7.18.0 through 7.32.0, when built with OpenSSL, disables the certificate CN and SAN name field verification (CURLOPT_SSL_VERIFYHOST) when the digital signature verification (CURLOPT_SSL_VERIFYPEER) is disabled, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Details
- CVSS 3.1 Base Score: 7.4
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade curl | Aug 30, 2017 | Nov 23, 2013 |
| Debian | — | Upgrade curl | Jul 30, 2024 | Nov 23, 2013 |
| Hpsmh | — | Upgrade to the latest version of HP System Management Homepage | Oct 13, 2015 | Nov 23, 2013 |
| Huawei Euleros 2_0_sp2 | — | Upgrade libcurlUpgrade libcurl-develUpgrade curl | Jun 17, 2020 | Nov 23, 2013 |
| Oracle Solaris | — | Upgrade entire/ to version 11.4-11.4.0.0.1.15.0 on Solaris 11.4Upgrade web/curl to version 7.21.2-0.175.1.18.0.3.0 on Solaris 11.1 | May 29, 2017 | Nov 23, 2013 |
| Suse | — | Upgrade curlUpgrade libcurl-develUpgrade libcurl4-x86Upgrade libcurl4-32bitUpgrade libcurl4Upgrade sle-sdk-release | Dec 23, 2013 | Nov 23, 2013 |
| Ubuntu | — | Upgrade libcurl3 | Nov 8, 2024 | Nov 23, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub