CVE-2023-28321

🗓️ 26 May 2023 00:00:00Reported by hackeroneType

An improper certificate validation vulnerability exists in curl <v8.1.0, allowing mismatches in wildcard patterns

Reporter	Title	Published	Views	Family All 230
IBM Security Bulletins	Security Bulletin: IBM MaaS360 Cloud Extender Agent, Configuration Utility, Certificate, and Base Module affected by multiple vulnerabilities (CVE-2023-28322, CVE-2023-28320, CVE-2023-28319, CVE-2023-28321)	2 Oct 202316:16	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM WebSphere Application Server Liberty, OpenSSL, libcurl, and Apache Xerces C++ XML parser may affect IBM Storage Protect for Virtual Environments: Data Protection for VMware	15 Apr 202502:41	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Wincollect is vulnerable to using components with known vulnerabilities	24 Jul 202317:54	–	ibm
IBM Security Bulletins	Security Bulletin: TSSC/IMC is vulnerable to aritrary code excecution due to curl (CVE-2023-27536, CVE-2023-28321)	8 Jul 202417:44	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM WebSphere Application Server Liberty, libcurl, Apache Xerces C++ XML parser, and Newtonsoft.Json may affect IBM Storage Protect for Virtual Environments: Data Protection for Hyper-V	18 Jun 202422:03	–	ibm
IBM Security Bulletins	Security Bulletin: Execution Engine for Apache Hadoop is vulnerable to heap-based buffer overflow and remote attacker to bypass security restrictions	20 Feb 202503:40	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in libcurl, cURL and Linux Kernel might affect IBM Storage Copy Data Management	14 Jun 202416:27	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple publicly disclosed libcurl vulnerabilities affect IBM Safer Payments	11 Dec 202315:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Engineering Requirements Management DOORS/DWA vulnerabilities addressed in 9.7.2.8	18 Oct 202407:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Ceph is vulnerable to Improper Certificate Validation in the RHEL UBI (CVE-2023-28321)	26 Jan 202421:52	–	ibm

NVD

Vulners

Node

haxx curlRange<8.1.0

Node

debian debian_linuxMatch10.0

fedoraproject fedoraMatch37

fedoraproject fedoraMatch38

Node

netapp clustered_data_ontapMatch-

netapp ontap_antivirus_connectorMatch-

Node

netapp h300s_firmwareMatch-

AND

netapp h300sMatch-

Node

netapp h500s_firmwareMatch-

AND

netapp h500sMatch-

Node

netapp h700s_firmwareMatch-

AND

netapp h700sMatch-

Node

netapp h410s_firmwareMatch-

AND

netapp h410sMatch-

Node

apple macosRange11.0–11.7.9

apple macosRange12.0–12.6.8

apple macosRange13.0–13.5

[
  {
    "vendor": "n/a",
    "product": "https://github.com/curl/curl",
    "versions": [
      {
        "version": "Fixed in 8.1.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
support	www.support.apple.com/kb/HT213844
hackerone	www.hackerone.com/reports/1950627
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F4I75RDGX5ULSSCBE5BF3P5I5SFO7ULQ/
security	www.security.netapp.com/advisory/ntap-20230609-0009/
lists	www.lists.debian.org/debian-lts-announce/2023/10/msg00016.html
support	www.support.apple.com/kb/HT213845
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z2LIWHWKOVH24COGGBCVOWDXXIUPKOMK/
security	www.security.gentoo.org/glsa/202310-12
seclists	www.seclists.org/fulldisclosure/2023/Jul/48
seclists	www.seclists.org/fulldisclosure/2023/Jul/47

15 Jan 2025 16:15Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.15.9

EPSS0.00297

SSVC

CWE-295