Curl 8.8.0 < 8.18.0 Improper Certificate Validation.

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(291358);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/30");

  script_cve_id("CVE-2025-13034");
  script_xref(name:"IAVA", value:"2026-A-0005-S");

  script_name(english:"Curl 8.8.0 < 8.18.0 Improper Certificate Validation.");

  script_set_attribute(attribute:"synopsis", value:
"The remote host has a program that is affected by an improper certificate validation vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of curl installed on the remote host is missing a security update. It is, therefore, affected by 
an improper certificate validation vulnerability.

  - When using the CURLOPT_PINNEDPUBLICKEY option with libcurl or --pinnedpubkey with the curl tool, 
    the public key check should be performed to verify the server certificate peer. 
    However, this check is skipped if the connection uses QUIC with ngtcp2 built against GnuTLS and 
    the user has explicitly disabled standard certificate verification. This could allow 
    a connection to an impostor server without the intended public key verification.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported 
version number.");
  script_set_attribute(attribute:"see_also", value:"https://curl.se/docs/CVE-2025-13034.html");
  script_set_attribute(attribute:"solution", value:
"Upgrade Curl to version 8.18.0 or later");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:N/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-13034");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/01/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/01/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/01/19");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"asset_categories", value:"component");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:haxx:curl");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("curl_win_installed.nbin", "curl_nix_installed.nbin");
  script_require_keys("installed_sw/Curl");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Curl', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'min_version': '8.8.0', 'fixed_version': '8.18.0'}
      ]
    }
  ]
};

var res = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING, check_backporting:TRUE);
vdf::handle_check_and_report_errors(vdf_result:res);