CVE-2016-3739: Input Validation
First published: Fri May 20 2016(Updated: )
The (1) mbed_connect_step1 function in lib/vtls/mbedtls.c and (2) polarssl_connect_step1 function in lib/vtls/polarssl.c in cURL and libcurl before 7.49.0, when using SSLv3 or making a TLS connection to a URL that uses a numerical IP address, allow remote attackers to spoof servers via an arbitrary valid certificate.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Haxx Curl | =7.21.0 | |
| Haxx Curl | =7.21.1 | |
| Haxx Curl | =7.21.2 | |
| Haxx Curl | =7.21.3 | |
| Haxx Curl | =7.21.4 | |
| Haxx Curl | =7.21.5 | |
| Haxx Curl | =7.21.6 | |
| Haxx Curl | =7.21.7 | |
| Haxx Curl | =7.22.0 | |
| Haxx Curl | =7.23.0 | |
| Haxx Curl | =7.23.1 | |
| Haxx Curl | =7.24.0 | |
| Haxx Curl | =7.25.0 | |
| Haxx Curl | =7.26.0 | |
| Haxx Curl | =7.27.0 | |
| Haxx Curl | =7.28.0 | |
| Haxx Curl | =7.28.1 | |
| Haxx Curl | =7.29.0 | |
| Haxx Curl | =7.30.0 | |
| Haxx Curl | =7.31.0 | |
| Haxx Curl | =7.32.0 | |
| Haxx Curl | =7.33.0 | |
| Haxx Curl | =7.34.0 | |
| Haxx Curl | =7.35.0 | |
| Haxx Curl | =7.36.0 | |
| Haxx Curl | =7.38.0 | |
| Haxx Curl | =7.39.0 | |
| Haxx Curl | =7.40.0 | |
| Haxx Curl | =7.41.0 | |
| Haxx Curl | =7.42.0 | |
| Haxx Curl | =7.42.1 | |
| Haxx Curl | =7.43.0 | |
| Haxx Curl | =7.44.0 | |
| Haxx Curl | =7.45.0 | |
| Haxx Curl | =7.46.0 | |
| Haxx Curl | =7.47.0 | |
| Haxx Curl | =7.48.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- http://www.securityfocus.com/bid/90726
- http://www.securitytracker.com/id/1035907
- http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.495349
- https://curl.haxx.se/CVE-2016-3739.patch
- https://curl.haxx.se/changes.html#7_49_0
- https://curl.haxx.se/docs/adv_20160518.html
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722
- https://security.gentoo.org/glsa/201701-47
- http://www.openwall.com/lists/oss-security/2024/03/27/4
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/weakness
- agent/last-modified-date
- agent/severity
- agent/author
- agent/tags
- agent/first-publish-date
- agent/event
- agent/description
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- vendor/haxx
- canonical/haxx curl
- version/haxx curl/7.21.0
- version/haxx curl/7.21.1
- version/haxx curl/7.21.2
- version/haxx curl/7.21.3
- version/haxx curl/7.21.4
- version/haxx curl/7.21.5
- version/haxx curl/7.21.6
- version/haxx curl/7.21.7
- version/haxx curl/7.22.0
- version/haxx curl/7.23.0
- version/haxx curl/7.23.1
- version/haxx curl/7.24.0
- version/haxx curl/7.25.0
- version/haxx curl/7.26.0
- version/haxx curl/7.27.0
- version/haxx curl/7.28.0
- version/haxx curl/7.28.1
- version/haxx curl/7.29.0
- version/haxx curl/7.30.0
- version/haxx curl/7.31.0
- version/haxx curl/7.32.0
- version/haxx curl/7.33.0
- version/haxx curl/7.34.0
- version/haxx curl/7.35.0
- version/haxx curl/7.36.0
- version/haxx curl/7.38.0
- version/haxx curl/7.39.0
- version/haxx curl/7.40.0
- version/haxx curl/7.41.0
- version/haxx curl/7.42.0
- version/haxx curl/7.42.1
- version/haxx curl/7.43.0
- version/haxx curl/7.44.0
- version/haxx curl/7.45.0
- version/haxx curl/7.46.0
- version/haxx curl/7.47.0
- version/haxx curl/7.48.0