CVE-2023-28321 Security feature bypass in https://github.com/curl/curl
Attackers can bypass TLS certificate validation in curl by exploiting incorrect IDN wildcard matching, allowing man-in-the-middle attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-28321?
CVE-2023-28321 is a medium-severity vulnerability in Apple Macos, published on 26 May 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to pattern match, but the wildcard check in curl could still check for `x*`, which would match even though the IDN name most likely contained nothing even resembling an `x`.
Weakness: CWE-295
Which versions are affected by CVE-2023-28321?
It affects 10 products.
Products include Apple Macos, Debian Debian Linux, Fedoraproject Fedora, Haxx Curl, Netapp Clustered Data Ontap, Netapp H300s Firmware and 4 more.
How do I fix CVE-2023-28321?
Upgrade to a fixed version.
Is CVE-2023-28321 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-28321 exists.
Other vulnerabilities in Apple Macos
Sources
Also known as ALPINE-CVE-2023-28321, AZL-26794, AZL-26808, AZL-26812, AZL-38032, CLEANSTART-2026-AH03908 and 5 more.