CVE-2013-4545

cURL & libcurl <7.33 - SSL Spoofing

Title source: llm
STIX 2.1

Description

cURL and libcurl 7.18.0 through 7.32.0, when built with OpenSSL, disables the certificate CN and SAN name field verification (CURLOPT_SSL_VERIFYHOST) when the digital signature verification (CURLOPT_SSL_VERIFYPEER) is disabled, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

References (9)

Core 9
Core References
Various Sources vendor-advisory x_refsource_hp
https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04463322
Vendor Advisory x_refsource_confirm
http://curl.haxx.se/docs/adv_20131115.html
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2013/dsa-2798
Mailing List vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2013-12/msg00047.html
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2048-1
Mailing List vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2013-12/msg00053.html

Scores

EPSS 0.0035
EPSS Percentile 57.5%

Details

CWE
CWE-310
Status published
Products (50)
haxx/curl 7.18.0
haxx/curl 7.18.1
haxx/curl 7.18.2
haxx/curl 7.19.0
haxx/curl 7.19.1
haxx/curl 7.19.2
haxx/curl 7.19.3
haxx/curl 7.19.4
haxx/curl 7.19.5
haxx/curl 7.19.6
... and 40 more
Published Nov 23, 2013
Tracked Since Feb 18, 2026