CVEvulnerability

CVE-2013-6422

4.0 MEDIUM Published 2013-12-23 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2013-12-23
Last modified
2026-06-17
Assigner
[email protected]
CVSS 2.0 ([email protected])
4.0 MEDIUM — AV:N/AC:H/Au:N/C:P/I:P/A:N
Weaknesses
CWE-20

Description

The GnuTLS backend in libcurl 7.21.4 through 7.33.0, when disabling digital signature verification (CURLOPT_SSL_VERIFYPEER), also disables the CURLOPT_SSL_VERIFYHOST check for CN or SAN host name fields, which makes it easier for remote attackers to spoof servers and conduct man-in-the-middle (MITM) attacks.

Affected configurations

• debian debian linux 7.0 • canonical ubuntu linux 12.04 • canonical ubuntu linux 12.10 • canonical ubuntu linux 13.04 • canonical ubuntu linux 13.10 • haxx libcurl 7.21.4 • haxx libcurl 7.21.5 • haxx libcurl 7.21.6 • haxx libcurl 7.21.7 • haxx libcurl 7.22.0 • haxx libcurl 7.23.0 • haxx libcurl 7.23.1 • haxx libcurl 7.24.0 • haxx libcurl 7.25.0 • haxx libcurl 7.26.0 • haxx libcurl 7.27.0 • haxx libcurl 7.28.0 • haxx libcurl 7.28.1 • haxx libcurl 7.29.0 • haxx libcurl 7.30.0 • haxx libcurl 7.31.0 • haxx libcurl 7.32.0 • haxx libcurl 7.33.0

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References