CVE-2013-4545: Medium severity curl vulnerability
cURL and libcurl 7.18.0 through 7.32.0, when built with OpenSSL, disables the certificate CN and SAN name field verification (CURLOPTSSLVERIFYHOST) when the digital signature verification (CURLOPTSSLVERIFYPEER) is disabled, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4545?
CVE-2013-4545 is considered a high severity vulnerability due to its potential to allow man-in-the-middle attacks.
How do I fix CVE-2013-4545?
To fix CVE-2013-4545, upgrade cURL and libcurl to a version later than 7.32.0, where the vulnerability has been addressed.
What are the affected versions of cURL for CVE-2013-4545?
The affected versions of cURL are from 7.18.0 to 7.32.0 when built with OpenSSL.
Can CVE-2013-4545 allow attackers to manipulate secure connections?
Yes, CVE-2013-4545 allows attackers to spoof SSL servers, compromising secure connections.
What configurations in cURL are affected by CVE-2013-4545?
CVE-2013-4545 affects cURL configurations where CURLOPT_SSL_VERIFYHOST is disabled when CURLOPT_SSL_VERIFYPEER is also turned off.