4

CVE-2013-6422

The GnuTLS backend in libcurl 7.21.4 through 7.33.0, when disabling digital signature verification (CURLOPT_SSL_VERIFYPEER), also disables the CURLOPT_SSL_VERIFYHOST check for CN or SAN host name fields, which makes it easier for remote attackers to spoof servers and conduct man-in-the-middle (MITM) attacks.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Debian ≫ Debian Linux Version 7.0
Canonical ≫ Ubuntu Linux Version 12.04 Update - Edition lts
Canonical ≫ Ubuntu Linux Version 12.10
Canonical ≫ Ubuntu Linux Version 13.04
Canonical ≫ Ubuntu Linux Version 13.10
Haxx ≫ Libcurl Version 7.21.4
Haxx ≫ Libcurl Version 7.21.5
Haxx ≫ Libcurl Version 7.21.6
Haxx ≫ Libcurl Version 7.21.7
Haxx ≫ Libcurl Version 7.22.0
Haxx ≫ Libcurl Version 7.23.0
Haxx ≫ Libcurl Version 7.23.1
Haxx ≫ Libcurl Version 7.24.0
Haxx ≫ Libcurl Version 7.25.0
Haxx ≫ Libcurl Version 7.26.0
Haxx ≫ Libcurl Version 7.27.0
Haxx ≫ Libcurl Version 7.28.0
Haxx ≫ Libcurl Version 7.28.1
Haxx ≫ Libcurl Version 7.29.0
Haxx ≫ Libcurl Version 7.30.0
Haxx ≫ Libcurl Version 7.31.0
Haxx ≫ Libcurl Version 7.32.0
Haxx ≫ Libcurl Version 7.33.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.8% 0.85
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4 4.9 4.9
AV:N/AC:H/Au:N/C:P/I:P/A:N
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04463322
http://curl.haxx.se/docs/adv_20131217.html
Vendor Advisory
http://www.debian.org/security/2013/dsa-2824
http://www.ubuntu.com/usn/USN-2058-1