Improper Certificate Validation Affecting curl package, versions <7.35.0-1ubuntu2.20+esm16


Severity

Recommended
low

Based on Ubuntu security rating.

Threat Intelligence

EPSS
0.22% (62nd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UBUNTU1404-CURL-5561954
  • published18 May 2023
  • disclosed26 May 2023

Introduced: 18 May 2023

CVE-2023-28321  (opens in a new tab)
CWE-295  (opens in a new tab)

How to fix?

Upgrade Ubuntu:14.04 curl to version 7.35.0-1ubuntu2.20+esm16 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Ubuntu. See How to fix? for Ubuntu:14.04 relevant fixed versions and status.

An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with xn-- and should not be allowed to pattern match, but the wildcard check in curl could still check for x*, which would match even though the IDN name most likely contained nothing even resembling an x.

CVSS Scores

version 3.1