CVE-2013-6422 in haxx.se cURL
Summary
The GnuTLS backend in libcurl 7.21.4 through 7.33.0, when disabling digital signature verification (CURLOPT_SSL_VERIFYPEER), also disables the CURLOPT_SSL_VERIFYHOST check for CN or SAN host name fields, which makes it easier for remote attackers to spoof servers and conduct man-in-the-middle (MITM) attacks.
Reservation
11/04/2013
Disclosure
12/23/2013
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 11554 | haxx.se cURL CN/SAN Name Field input validation | 20 | Proof-of-Concept | Not defined | CVE-2013-6422 |