CVE-2013-6422
Description
The GnuTLS backend in libcurl 7.21.4 through 7.33.0, when disabling digital signature verification (CURLOPT_SSL_VERIFYPEER), also disables the CURLOPT_SSL_VERIFYHOST check for CN or SAN host name fields, which makes it easier for remote attackers to spoof servers and conduct man-in-the-middle (MITM) attacks.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Mitigation details
CVE-2013-6422 NameCVE-2013-6422 DescriptionThe GnuTLS backend in libcurl 7.21.4 through 7.33.0, when disabling digital signature verification (CURLOPT_SSL_VERIFYPEER), also disables the CURLOPT_SSL_VERIFYHOST check for CN or SAN host name fields, which makes it easier for remote attackers to spoof servers and conduct man-in-the-middle (MITM) attacks. SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec,…
CVE-2013-6422
| Name | CVE-2013-6422 |
| Description | The GnuTLS backend in libcurl 7.21.4 through 7.33.0, when disabling digital signature verification (CURLOPT_SSL_VERIFYPEER), also disables the CURLOPT_SSL_VERIFYHOST check for CN or SAN host name fields, which makes it easier for remote attackers to spoof servers and conduct man-in-the-middle (MITM) attacks. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DSA-2824-1 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| curl (PTS) | bullseye | 7.74.0-1.3+deb11u13 | fixed |
| bullseye (security) | 7.74.0-1.3+deb11u16 | fixed | |
| bookworm | 7.88.1-10+deb12u14 | fixed | |
| bookworm (security) | 7.88.1-10+deb12u5 | fixed | |
| trixie | 8.14.1-2+deb13u3 | fixed | |
| forky | 8.20.0-2 | fixed | |
| sid | 8.20.0-3 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| curl | source | squeeze | (not affected) | |||
| curl | source | wheezy | 7.26.0-1+wheezy7 | DSA-2824-1 | ||
| curl | source | (unstable) | 7.34.0-1 |
Notes
[squeeze] - curl <not-affected> (issue introduced with 59cf93cc, 7.21.4)
Apply commands
[squeeze] - curl <not-affected> (issue introduced with 59cf93cc, 7.21.4)OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| debian | bookworm | fixed | 7.34.0-1 |
| debian | bullseye | fixed | 7.34.0-1 |
| debian | forky | fixed | 7.34.0-1 |
| debian | sid | fixed | 7.34.0-1 |
| debian | trixie | fixed | 7.34.0-1 |
| debian | 7.0 | affected | |
| ubuntu | 12.04 | affected | |
| ubuntu | 12.10 | affected | |
| ubuntu | 13.04 | affected | |
| ubuntu | 13.10 | affected | |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| haxx | libcurl | 7.21.4 | |
| haxx | libcurl | 7.21.5 | |
| haxx | libcurl | 7.21.6 | |
| haxx | libcurl | 7.21.7 | |
| haxx | libcurl | 7.22.0 | |
| haxx | libcurl | 7.23.0 | |
| haxx | libcurl | 7.23.1 | |
| haxx | libcurl | 7.24.0 | |
| haxx | libcurl | 7.25.0 | |
| haxx | libcurl | 7.26.0 | |
| haxx | libcurl | 7.27.0 | |
| haxx | libcurl | 7.28.0 | |
| haxx | libcurl | 7.28.1 | |
| haxx | libcurl | 7.29.0 | |
| haxx | libcurl | 7.30.0 | |
| haxx | libcurl | 7.31.0 | |
| haxx | libcurl | 7.32.0 | |
| haxx | libcurl | 7.33.0 | |
References
- http://curl.haxx.se/docs/adv_20131217.html
- http://www.debian.org/security/2013/dsa-2824
- http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
- http://www.ubuntu.com/usn/USN-2058-1
- https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04463322
- https://security-tracker.debian.org/tracker/CVE-2013-6422
CWEs
CWE-20
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.