CVE-2013-4545 Security feature bypass in n/a
Man-in-the-middle attackers can spoof SSL servers by exploiting disabled certificate verification in libcurl when peer verification is also disabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-4545?
CVE-2013-4545 is a medium-severity vulnerability in Haxx Curl, published on 23 Nov 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
cURL and libcurl 7.18.0 through 7.32.0, when built with OpenSSL, disables the certificate CN and SAN name field verification (CURLOPT_SSL_VERIFYHOST) when the digital signature verification (CURLOPT_SSL_VERIFYPEER) is disabled, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Weakness: CWE-310
Which versions are affected by CVE-2013-4545?
It affects 2 products.
Products include Haxx Curl, Haxx Libcurl.
How do I fix CVE-2013-4545?
Upgrade to a fixed version.
Is CVE-2013-4545 being exploited?
There is no known exploitation of CVE-2013-4545 in the wild and no public exploit code.
Other vulnerabilities in Haxx Curl
Sources
Also known as CURL-CVE-2013-4545, DEBIAN-CVE-2013-4545, DSA-2798-1, GHSA-94rh-gwj6-33j3, MGASA-2013-0338.