CVE-2009-2417: High severity libcurl vulnerability

Published Aug 14, 2009

Updated

lib/ssluse.c in cURL and libcurl 7.4 through 7.19.5, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Affected Software

74 affected components

curl libcurl=7.4

curl libcurl=7.4.1

curl libcurl=7.4.2

curl libcurl=7.5

curl libcurl=7.5.1

curl libcurl=7.5.2

curl libcurl=7.6

curl libcurl=7.6.1

curl libcurl=7.7

curl libcurl=7.7.1

curl libcurl=7.7.2

curl libcurl=7.7.3

curl libcurl=7.8

curl libcurl=7.8.1

curl libcurl=7.9

curl libcurl=7.9.1

curl libcurl=7.9.2

curl libcurl=7.9.3

curl libcurl=7.9.5

curl libcurl=7.9.6

curl libcurl=7.9.7

curl libcurl=7.9.8

curl libcurl=7.10

curl libcurl=7.10.1

curl libcurl=7.10.2

curl libcurl=7.10.3

curl libcurl=7.10.4

curl libcurl=7.10.5

curl libcurl=7.10.6

curl libcurl=7.10.7

curl libcurl=7.10.8

curl libcurl=7.11.0

curl libcurl=7.11.1

curl libcurl=7.11.2

curl libcurl=7.12

curl libcurl=7.12.0

curl libcurl=7.12.1

curl libcurl=7.12.2

curl libcurl=7.12.3

curl libcurl=7.13

curl libcurl=7.13.1

curl libcurl=7.13.2

curl libcurl=7.14

curl libcurl=7.14.1

curl libcurl=7.15

curl libcurl=7.15.1

curl libcurl=7.15.2

curl libcurl=7.15.3

curl libcurl=7.16.3

curl libcurl=7.17.0

curl libcurl=7.17.1

curl libcurl=7.18.0

curl libcurl=7.18.1

curl libcurl=7.18.2

curl libcurl=7.19.0

curl libcurl=7.19.1

curl libcurl=7.19.2

curl libcurl=7.19.3

curl libcurl=7.19.4

curl libcurl=7.19.5

libcurl libcurl=7.12

libcurl libcurl=7.12.1

libcurl libcurl=7.12.2

libcurl libcurl=7.12.3

libcurl libcurl=7.13

libcurl libcurl=7.13.1

libcurl libcurl=7.13.2

libcurl libcurl=7.14

libcurl libcurl=7.14.1

libcurl libcurl=7.15

libcurl libcurl=7.15.1

libcurl libcurl=7.15.2

libcurl libcurl=7.15.3

libcurl libcurl=7.16.3

Remediation

Event History

Aug 14, 2009

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2009-2417?

CVE-2009-2417 has a moderate severity level due to its potential for man-in-the-middle attacks.

How do I fix CVE-2009-2417?

To fix CVE-2009-2417, upgrade to a libcurl version higher than 7.19.5, as the vulnerability has been addressed in subsequent releases.

Which versions are affected by CVE-2009-2417?

CVE-2009-2417 affects cURL and libcurl versions from 7.4 through 7.19.5.

What type of attack does CVE-2009-2417 allow?

CVE-2009-2417 allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate.

Is there a patch available for CVE-2009-2417?

Yes, patches are available for affected versions of cURL and libcurl to mitigate CVE-2009-2417.

CVE-2009-2417: High severity libcurl vulnerability

Affected Software

Remediation

Patch Available

Patch Available

Patch Available

Patch Available

Patch Available

Patch Available

Patch Available

Patch Available

Patch Available

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2009-2417?

How do I fix CVE-2009-2417?

Which versions are affected by CVE-2009-2417?

What type of attack does CVE-2009-2417 allow?

Is there a patch available for CVE-2009-2417?

Company

Resources

Contact