The GnuTLS backend in libcurl 7.21.4 through 7.33.0, when disabling digital signature verification (CURLOPT_SSL_VERIFYPEER), also disables the CURLOPT_SSL_VERIFYHOST check for CN or SAN host name fields, which makes it easier for remote attackers to spoof servers and conduct man-in-the-middle (MITM) attacks.
CVSS Details
- CVSS 3.1 Base Score: 5.9
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade curl | Jul 30, 2024 | Dec 23, 2013 |
| Freebsd | — | Upgrade curl | Dec 10, 2025 | Dec 18, 2013 |
| Gentoo Linux | — | Upgrade net-misc/curl. | Oct 30, 2017 | Dec 23, 2013 |
| Hpsmh | — | Upgrade to the latest version of HP System Management Homepage | Oct 13, 2015 | Dec 23, 2013 |
| Huawei Euleros 2_0_sp2 | — | Upgrade libcurlUpgrade curlUpgrade libcurl-devel | Jun 17, 2020 | Dec 23, 2013 |
| Huawei Euleros 2_0_sp3 | — | Upgrade curlUpgrade libcurl-develUpgrade libcurl | Apr 30, 2021 | Dec 23, 2013 |
| Oracle Solaris | — | Upgrade entire/ to version 11.4-11.4.0.0.1.15.0 on Solaris 11.4 | Oct 19, 2018 | Dec 23, 2013 |
| Ubuntu | — | Upgrade libcurl3-gnutls | Nov 8, 2024 | Dec 23, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub