5.7 Medium
AI Score
Confidence
Low
4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
HIGH
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:H/Au:N/C:P/I:P/A:N
0.002 Low
EPSS
Percentile
64.2%
Marc Deslauriers discovered that libcurl incorrectly verified CN and SAN
name fields when digital signature verification was disabled in the GnuTLS
backend. When libcurl is being used in this uncommon way by specific
applications, an attacker could exploit this to perform a machine-in-the-middle
attack to view sensitive information or alter encrypted communications.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Ubuntu | 13.10 | noarch | libcurl3-gnutls | <Â 7.32.0-1ubuntu1.2 | UNKNOWN |
Ubuntu | 13.10 | noarch | curl | <Â 7.32.0-1ubuntu1.2 | UNKNOWN |
Ubuntu | 13.10 | noarch | curl-udeb | <Â 7.32.0-1ubuntu1.2 | UNKNOWN |
Ubuntu | 13.10 | noarch | libcurl3 | <Â 7.32.0-1ubuntu1.2 | UNKNOWN |
Ubuntu | 13.10 | noarch | libcurl3-dbg | <Â 7.32.0-1ubuntu1.2 | UNKNOWN |
Ubuntu | 13.10 | noarch | libcurl3-nss | <Â 7.32.0-1ubuntu1.2 | UNKNOWN |
Ubuntu | 13.10 | noarch | libcurl3-udeb | <Â 7.32.0-1ubuntu1.2 | UNKNOWN |
Ubuntu | 13.10 | noarch | libcurl4-gnutls-dev | <Â 7.32.0-1ubuntu1.2 | UNKNOWN |
Ubuntu | 13.10 | noarch | libcurl4-nss-dev | <Â 7.32.0-1ubuntu1.2 | UNKNOWN |
Ubuntu | 13.10 | noarch | libcurl4-openssl-dev | <Â 7.32.0-1ubuntu1.2 | UNKNOWN |