Apple macOS up to 13.4.1 curl certificate validation

Summaryinfo

A vulnerability identified as problematic has been detected in Apple macOS up to 13.4.1. This issue affects some unknown processing of the component curl. The manipulation leads to an unknown weakness. This vulnerability is traded as CVE-2023-28321. An attack has to be approached locally. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Apple macOS up to 13.4.1 (Operating System). It has been rated as problematic. This issue affects some unknown functionality of the component curl. Using CWE to declare the problem leads to CWE-295. The product does not validate, or incorrectly validates, a certificate. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to pattern match, but the wildcard check in curl could still check for `x*`, which would match even though the IDN name most likely contained nothing even resembling an `x`.

The weakness was shared 07/24/2023 as HT213843 as confirmed advisory (Website). The advisory is shared at support.apple.com. The identification of this vulnerability is CVE-2023-28321. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1587.003 for this issue. The advisory points out:

Multiple issues in curl

The vulnerability scanner Nessus provides a plugin with the ID 276313 (TencentOS Server 3: curl (TSSA-2023:0172)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 13.5 eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability. The advisory contains the following remark:

Multiple issues were addressed by updating curl.

The vulnerability is also documented in the databases at Tenable (276313) and EUVD (EUVD-2023-32028). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Operating System

Vendor

• Apple

Name

• macOS

Version

• 13.4.0
• 13.4.1

License

• commercial

Website

• Vendor: https://www.apple.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion