CVEvulnerability

CVE-2016-3739

5.3 MEDIUM Published 2016-05-20 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2016-05-20
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
5.3 MEDIUM — CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS 2.0 ([email protected])
2.6 LOW — AV:N/AC:H/Au:N/C:N/I:P/A:N
Weaknesses
CWE-20

Description

The (1) mbed_connect_step1 function in lib/vtls/mbedtls.c and (2) polarssl_connect_step1 function in lib/vtls/polarssl.c in cURL and libcurl before 7.49.0, when using SSLv3 or making a TLS connection to a URL that uses a numerical IP address, allow remote attackers to spoof servers via an arbitrary valid certificate.

Affected configurations

• haxx curl 7.21.0 • haxx curl 7.21.1 • haxx curl 7.21.2 • haxx curl 7.21.3 • haxx curl 7.21.4 • haxx curl 7.21.5 • haxx curl 7.21.6 • haxx curl 7.21.7 • haxx curl 7.22.0 • haxx curl 7.23.0 • haxx curl 7.23.1 • haxx curl 7.24.0 • haxx curl 7.25.0 • haxx curl 7.26.0 • haxx curl 7.27.0 • haxx curl 7.28.0 • haxx curl 7.28.1 • haxx curl 7.29.0 • haxx curl 7.30.0 • haxx curl 7.31.0 • haxx curl 7.32.0 • haxx curl 7.33.0 • haxx curl 7.34.0 • haxx curl 7.35.0 • haxx curl 7.36.0 • haxx curl 7.38.0 • haxx curl 7.39.0 • haxx curl 7.40.0 • haxx curl 7.41.0 • haxx curl 7.42.0 • haxx curl 7.42.1 • haxx curl 7.43.0 • haxx curl 7.44.0 • haxx curl 7.45.0 • haxx curl 7.46.0 • haxx curl 7.47.0 • haxx curl 7.48.0

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References