CVE-2013-6422: Input Validation
The GnuTLS backend in libcurl 7.21.4 through 7.33.0, when disabling digital signature verification (CURLOPTSSLVERIFYPEER), also disables the CURLOPTSSLVERIFYHOST check for CN or SAN host name fields, which makes it easier for remote attackers to spoof servers and conduct man-in-the-middle (MITM) attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Do not disable digital signature verification; ensure CURLOPT_SSL_VERIFYPEER is enabled to prevent the related GnuTLS behavior from also disabling the CURLOPT_SSL_VERIFYHOST hostname check (in affected versions 7.21.4 through 7.33.0).
libcurl (GnuTLS backend) CURLOPT_SSL_VERIFYPEER = true - Compensating control
If you must run on affected libcurl versions (7.21.4 through 7.33.0), avoid MITM risk by not using settings that disable TLS verification (i.e., do not set CURLOPT_SSL_VERIFYPEER to disable verification), since this also makes it easier to spoof servers due to the hostname-check being disabled.
Event History
Frequently Asked Questions
What is the severity of CVE-2013-6422?
CVE-2013-6422 is considered a high severity vulnerability due to the potential for man-in-the-middle attacks.
How do I fix CVE-2013-6422?
To fix CVE-2013-6422, it is recommended to upgrade to a version of libcurl later than 7.33.0.
Which versions of libcurl are affected by CVE-2013-6422?
CVE-2013-6422 affects libcurl versions from 7.21.4 to 7.33.0.
What impact does CVE-2013-6422 have on security?
CVE-2013-6422 allows remote attackers to spoof server identities, potentially leading to unauthorized access to sensitive information.
Is it safe to disable CURLOPT_SSL_VERIFYPEER due to CVE-2013-6422?
Disabling CURLOPT_SSL_VERIFYPEER is not safe with CVE-2013-6422 as it also disables critical hostname verification checks.