NetSight
IP …
medium5.9

CVE-2023-28321

An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternativ…

Impact

An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to pattern match, but the wildcard check in curl could still check for `x*`, which would match even though the IDN name most likely contained nothing even resembling an `x`.

Affected products

VendorProductAffected versions
HaxxCurl
before 8.1.0
DebianDebian Linux
Version 10.0
FedoraprojectFedora
Versions 37, 38
NetappClustered Data Ontap
All versions
NetappOntap Antivirus Connector
All versions
NetappH300s Firmware
All versions
NetappH500s Firmware
All versions
NetappH700s Firmware
All versions
NetappH410s Firmware
All versions
AppleMacos
from 11.0 before 11.7.9
from 12.0 before 12.6.8
from 13.0 before 13.5

Weakness classification

CWE-295

References