Marc Deslauriers discovered that libcurl incorrectly verified CN and SAN
name fields when digital signature verification was disabled in the GnuTLS
backend. When libcurl is being used in this uncommon way by specific
applications, an attacker could exploit this to perform a machine-in-the-middle
attack to view sensitive information or alter encrypted communications.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Ubuntu | 13.10 | noarch | libcurl3-gnutls | < 7.32.0-1ubuntu1.2 | UNKNOWN |
Ubuntu | 13.10 | noarch | curl | < 7.32.0-1ubuntu1.2 | UNKNOWN |
Ubuntu | 13.10 | noarch | curl-udeb | < 7.32.0-1ubuntu1.2 | UNKNOWN |
Ubuntu | 13.10 | noarch | libcurl3 | < 7.32.0-1ubuntu1.2 | UNKNOWN |
Ubuntu | 13.10 | noarch | libcurl3-dbg | < 7.32.0-1ubuntu1.2 | UNKNOWN |
Ubuntu | 13.10 | noarch | libcurl3-nss | < 7.32.0-1ubuntu1.2 | UNKNOWN |
Ubuntu | 13.10 | noarch | libcurl3-udeb | < 7.32.0-1ubuntu1.2 | UNKNOWN |
Ubuntu | 13.10 | noarch | libcurl4-gnutls-dev | < 7.32.0-1ubuntu1.2 | UNKNOWN |
Ubuntu | 13.10 | noarch | libcurl4-nss-dev | < 7.32.0-1ubuntu1.2 | UNKNOWN |
Ubuntu | 13.10 | noarch | libcurl4-openssl-dev | < 7.32.0-1ubuntu1.2 | UNKNOWN |