Unchecked TLS/SSL Certificate Host Name in curl
Summary
DSA-2824-1: curl - unchecked tls/ssl certificate host name. Affects curl versions < 7.26.0-1+wheezy7. Fixed in 7.26.0-1+wheezy7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Curl is a popular file retrieval tool used for transferring data with URLs. It supports various protocols, including HTTP, HTTPS, FTP, and more. The vulnerability in question affects the libcurl GnuTLS backend used by curl. This backend is responsible for handling TLS/SSL connections. The issue arises when digital signature verification is disabled, leading to the skipping of verifying the Common Name (CN) and Subject Alternative Name (SAN) fields in TLS/SSL certificates.
Vulnerability Detail
The vulnerability allows an attacker to bypass the verification of the host name in TLS/SSL certificates. This means that even if the certificate presented by the server does not match the expected host name, curl would still establish a connection without raising any warnings or errors. This could potentially allow an attacker to perform man-in-the-middle attacks, intercept sensitive data, or impersonate a trusted server.
How To Fix
Minimum fixed version
7.26.0-1+wheezy7
This is the first release that contains the fix.
sudo apt-get install --only-upgrade curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring that digital signature verification is enabled in the curl configuration. Additionally, it is crucial to regularly update the curl package to the latest version to stay protected against known vulnerabilities.
Conclusion
The unchecked TLS/SSL certificate host name vulnerability in curl can pose significant security risks if digital signature verification is disabled. It is crucial to upgrade to the fixed versions of curl and ensure that digital signature verification is enabled. Regularly updating the curl package and staying informed about security advisories is essential to maintain a secure environment. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for curl →
FAQ
Curl is a command-line tool and library for transferring data with URLs. It supports various protocols and is widely used for automation, scripting, and web development.
The vulnerability allows an attacker to bypass host name verification in TLS/SSL certificates, potentially leading to man-in-the-middle attacks, data interception, or impersonation of trusted servers.
The default configuration of the curl package is not affected by this vulnerability since digital signature verification is enabled by default. However, versions prior to 7.26.0-1+wheezy7 for the stable distribution (wheezy) and versions prior to 7.34.0-1 for the unstable distribution (sid) are vulnerable if digital signature verification is disabled.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
You can find more information about this vulnerability in the Debian Security Advisory DSA-2824-1 (https://storage.googleapis.com/debian-osv/dsa-osv/DSA-2824-1.json).
Related vulnerabilities
Recent vulnerabilities recorded for curl.
