CVE

Id
64492  
CVE No.
CVE-2013-4545  
Status
Candidate  
Description
cURL and libcurl 7.18.0 through 7.32.0, when built with OpenSSL, disables the certificate CN and SAN name field verification (CURLOPT_SSL_VERIFYHOST) when the digital signature verification (CURLOPT_SSL_VERIFYPEER) is disabled, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.  
Phase
Assigned (20130612)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
635664 64492 CVE-2013-4545 CONFIRM:http://curl.haxx.se/docs/adv_20131115.html  View
635665 64492 CVE-2013-4545 CONFIRM:http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html  View
635666 64492 CVE-2013-4545 CONFIRM:http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html  View
635667 64492 CVE-2013-4545 CONFIRM:http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html  View
635668 64492 CVE-2013-4545 DEBIAN:DSA-2798  View
635669 64492 CVE-2013-4545 URL:http://www.debian.org/security/2013/dsa-2798  View
635670 64492 CVE-2013-4545 HP:HPSBMU03112  View
635671 64492 CVE-2013-4545 URL:https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04463322  View
635672 64492 CVE-2013-4545 SUSE:openSUSE-SU-2013:1859  View
635673 64492 CVE-2013-4545 URL:http://lists.opensuse.org/opensuse-updates/2013-12/msg00047.html  View
635674 64492 CVE-2013-4545 SUSE:openSUSE-SU-2013:1865  View
635675 64492 CVE-2013-4545 URL:http://lists.opensuse.org/opensuse-updates/2013-12/msg00053.html  View
635676 64492 CVE-2013-4545 UBUNTU:USN-2048-1  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
24137 JVNDB-2013-005712 Bip における他のソケットに書き込まれる脆弱性 Bip は、デーモンとして実行している場合、stderr がクローズされる前に、以前 stderr に関連付けられていた予期しないファイル記述子に SSL ハンドシェイクエラーを書き込むため、他のソケットに書き込まれるなど、不特定の影響を受ける脆弱性が存在します。 CVE-2013-4550 64492 5.1 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-005712.html  View