Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2023-28321

An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to pattern match, but the wildcard check in curl could still check for `x*`, which would match even though the IDN name most likely contained nothing even resembling an `x`.

Published

2023-05-26T21:15:16.020

Last Modified

2025-01-15T16:15:26.203

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.9 (MEDIUM)

Weaknesses
  • Type: Secondary
    CWE-295
  • Type: Primary
    CWE-295
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application haxx curl < 8.1.0 Yes
Operating System debian debian_linux 10.0 Yes
Operating System fedoraproject fedora 37 Yes
Operating System fedoraproject fedora 38 Yes
Application netapp clustered_data_ontap - Yes
Application netapp ontap_antivirus_connector - Yes
Operating System netapp h300s_firmware - Yes
Hardware netapp h300s - No
Operating System netapp h500s_firmware - Yes
Hardware netapp h500s - No
Operating System netapp h700s_firmware - Yes
Hardware netapp h700s - No
Operating System netapp h410s_firmware - Yes
Hardware netapp h410s - No
Operating System apple macos < 11.7.9 Yes
Operating System apple macos < 12.6.8 Yes
Operating System apple macos < 13.5 Yes
References