CVE-2013-4545
First published: Sat Nov 23 2013(Updated: )
cURL and libcurl 7.18.0 through 7.32.0, when built with OpenSSL, disables the certificate CN and SAN name field verification (CURLOPT_SSL_VERIFYHOST) when the digital signature verification (CURLOPT_SSL_VERIFYPEER) is disabled, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Haxx Curl | =7.18.0 | |
| Haxx Curl | =7.18.1 | |
| Haxx Curl | =7.18.2 | |
| Haxx Curl | =7.19.0 | |
| Haxx Curl | =7.19.1 | |
| Haxx Curl | =7.19.2 | |
| Haxx Curl | =7.19.3 | |
| Haxx Curl | =7.19.4 | |
| Haxx Curl | =7.19.5 | |
| Haxx Curl | =7.19.6 | |
| Haxx Curl | =7.19.7 | |
| Haxx Curl | =7.20.0 | |
| Haxx Curl | =7.20.1 | |
| Haxx Curl | =7.21.0 | |
| Haxx Curl | =7.21.1 | |
| Haxx Curl | =7.21.2 | |
| Haxx Curl | =7.21.3 | |
| Haxx Curl | =7.21.4 | |
| Haxx Curl | =7.21.5 | |
| Haxx Curl | =7.21.6 | |
| Haxx Curl | =7.21.7 | |
| Haxx Curl | =7.22.0 | |
| Haxx Curl | =7.23.0 | |
| Haxx Curl | =7.23.1 | |
| Haxx Curl | =7.24.0 | |
| Haxx Curl | =7.25.0 | |
| Haxx Curl | =7.26.0 | |
| Haxx Curl | =7.27.0 | |
| Haxx Curl | =7.28.0 | |
| Haxx Curl | =7.28.1 | |
| Haxx Curl | =7.29.0 | |
| Haxx Curl | =7.30.0 | |
| Haxx Curl | =7.31.0 | |
| Haxx Curl | =7.32.0 | |
| Haxx Libcurl | =7.18.0 | |
| Haxx Libcurl | =7.18.1 | |
| Haxx Libcurl | =7.18.2 | |
| Haxx Libcurl | =7.19.0 | |
| Haxx Libcurl | =7.19.1 | |
| Haxx Libcurl | =7.19.2 | |
| Haxx Libcurl | =7.19.3 | |
| Haxx Libcurl | =7.19.4 | |
| Haxx Libcurl | =7.19.5 | |
| Haxx Libcurl | =7.19.6 | |
| Haxx Libcurl | =7.19.7 | |
| Haxx Libcurl | =7.20.0 | |
| Haxx Libcurl | =7.20.1 | |
| Haxx Libcurl | =7.21.0 | |
| Haxx Libcurl | =7.21.1 | |
| Haxx Libcurl | =7.21.2 | |
| Haxx Libcurl | =7.21.3 | |
| Haxx Libcurl | =7.21.4 | |
| Haxx Libcurl | =7.21.5 | |
| Haxx Libcurl | =7.21.6 | |
| Haxx Libcurl | =7.21.7 | |
| Haxx Libcurl | =7.22.0 | |
| Haxx Libcurl | =7.23.0 | |
| Haxx Libcurl | =7.23.1 | |
| Haxx Libcurl | =7.24.0 | |
| Haxx Libcurl | =7.25.0 | |
| Haxx Libcurl | =7.26.0 | |
| Haxx Libcurl | =7.27.0 | |
| Haxx Libcurl | =7.28.0 | |
| Haxx Libcurl | =7.28.1 | |
| Haxx Libcurl | =7.29.0 | |
| Haxx Libcurl | =7.30.0 | |
| Haxx Libcurl | =7.31.0 | |
| Haxx Libcurl | =7.32.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://curl.haxx.se/docs/adv_20131115.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00047.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00053.html
- http://www.debian.org/security/2013/dsa-2798
- http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html
- http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
- http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
- http://www.ubuntu.com/usn/USN-2048-1
- https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04463322
- collector/nvd-index
- agent/severity
- agent/author
- agent/type
- agent/event
- agent/references
- agent/weakness
- agent/last-modified-date
- agent/first-publish-date
- agent/softwarecombine
- agent/tags
- agent/description
- collector/mitre-cve
- source/MITRE
- vendor/haxx
- canonical/haxx curl
- version/haxx curl/7.18.0
- version/haxx curl/7.18.1
- version/haxx curl/7.18.2
- version/haxx curl/7.19.0
- version/haxx curl/7.19.1
- version/haxx curl/7.19.2
- version/haxx curl/7.19.3
- version/haxx curl/7.19.4
- version/haxx curl/7.19.5
- version/haxx curl/7.19.6
- version/haxx curl/7.19.7
- version/haxx curl/7.20.0
- version/haxx curl/7.20.1
- version/haxx curl/7.21.0
- version/haxx curl/7.21.1
- version/haxx curl/7.21.2
- version/haxx curl/7.21.3
- version/haxx curl/7.21.4
- version/haxx curl/7.21.5
- version/haxx curl/7.21.6
- version/haxx curl/7.21.7
- version/haxx curl/7.22.0
- version/haxx curl/7.23.0
- version/haxx curl/7.23.1
- version/haxx curl/7.24.0
- version/haxx curl/7.25.0
- version/haxx curl/7.26.0
- version/haxx curl/7.27.0
- version/haxx curl/7.28.0
- version/haxx curl/7.28.1
- version/haxx curl/7.29.0
- version/haxx curl/7.30.0
- version/haxx curl/7.31.0
- version/haxx curl/7.32.0
- canonical/haxx libcurl
- version/haxx libcurl/7.18.0
- version/haxx libcurl/7.18.1
- version/haxx libcurl/7.18.2
- version/haxx libcurl/7.19.0
- version/haxx libcurl/7.19.1
- version/haxx libcurl/7.19.2
- version/haxx libcurl/7.19.3
- version/haxx libcurl/7.19.4
- version/haxx libcurl/7.19.5
- version/haxx libcurl/7.19.6
- version/haxx libcurl/7.19.7
- version/haxx libcurl/7.20.0
- version/haxx libcurl/7.20.1
- version/haxx libcurl/7.21.0
- version/haxx libcurl/7.21.1
- version/haxx libcurl/7.21.2
- version/haxx libcurl/7.21.3
- version/haxx libcurl/7.21.4
- version/haxx libcurl/7.21.5
- version/haxx libcurl/7.21.6
- version/haxx libcurl/7.21.7
- version/haxx libcurl/7.22.0
- version/haxx libcurl/7.23.0
- version/haxx libcurl/7.23.1
- version/haxx libcurl/7.24.0
- version/haxx libcurl/7.25.0
- version/haxx libcurl/7.26.0
- version/haxx libcurl/7.27.0
- version/haxx libcurl/7.28.0
- version/haxx libcurl/7.28.1
- version/haxx libcurl/7.29.0
- version/haxx libcurl/7.30.0
- version/haxx libcurl/7.31.0
- version/haxx libcurl/7.32.0