CVE-2023-28321

Katalog CVE

CVSS 5.9 · Medium EPSS 1,8%

Kerentanan Improper Certificate Validation pada haxx curl, debian linux +8 lainnya. Skor CVSS 3.1 5.9 (Medium) menurut NVD.

Deskripsi (NVD)

An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to pattern match, but the wildcard check in curl could still check for `x*`, which would match even though the IDN name most likely contained nothing even resembling an `x`.

Rincian

Terbit di NVD

26 Mei 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-295: Improper Certificate Validation

EPSS (30 hari)

1,8% peluang dieksploitasi; lebih tinggi dari 78,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://hackerone.com/reports/1950627 exploit · patch · advisory pihak ketiga
• http://seclists.org/fulldisclosure/2023/Jul/47 mailing list · advisory pihak ketiga
• http://seclists.org/fulldisclosure/2023/Jul/48 mailing list · advisory pihak ketiga
• http://seclists.org/fulldisclosure/2023/Jul/52 mailing list · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2023/10/msg00016.html mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202310-12 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20230609-0009/ advisory pihak ketiga
• https://support.apple.com/kb/HT213843 advisory pihak ketiga
• https://support.apple.com/kb/HT213844 advisory pihak ketiga
• https://support.apple.com/kb/HT213845 advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F4I75RDGX5ULS...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z2LIWHWKOVH24...