Vulnerability · Published May 26, 2023 · Assigned by hackerone
CVE-2023-28321
Medium 5.9
In plain English
A medium-severity improper certificate validation in https://github.com/curl/curl. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 79% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to pattern match, but the wildcard check in curl could still check for `x*`, which would match even though the IDN name most likely contained nothing even resembling an `x`.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | curl | 7.61.1-30.el8_8.3 | ALSA-2023:4523 |
| AlmaLinux:9 | curl | 7.76.1-23.el9_2.2 | ALSA-2023:4354 |
| AlmaLinux:9 | curl-minimal | 7.76.1-23.el9_2.2 | ALSA-2023:4354 |
| AlmaLinux:8 | libcurl | 7.61.1-30.el8_8.3 | ALSA-2023:4523 |
| AlmaLinux:9 | libcurl | 7.76.1-23.el9_2.2 | ALSA-2023:4354 |
| AlmaLinux:8 | libcurl-devel | 7.61.1-30.el8_8.3 | ALSA-2023:4523 |
| AlmaLinux:9 | libcurl-devel | 7.76.1-23.el9_2.2 | ALSA-2023:4354 |
| AlmaLinux:8 | libcurl-minimal | 7.61.1-30.el8_8.3 | ALSA-2023:4523 |
| AlmaLinux:9 | libcurl-minimal | 7.76.1-23.el9_2.2 | ALSA-2023:4354 |
| Alpine:v3.20 | curl | 8.1.0-r0 | ALPINE-CVE-2023-28321 |
| Alpine:v3.21 | curl | 8.1.0-r0 | ALPINE-CVE-2023-28321 |
| Alpine:v3.22 | curl | 8.1.0-r0 | ALPINE-CVE-2023-28321 |
| Alpine:v3.23 | curl | 8.1.0-r0 | ALPINE-CVE-2023-28321 |
| Alpine:v3.24 | curl | 8.1.0-r0 | ALPINE-CVE-2023-28321 |
| Debian:12 | curl | 7.88.1-10 | DEBIAN-CVE-2023-28321 |
| Debian:13 | curl | 7.88.1-10 | DEBIAN-CVE-2023-28321 |
| Debian:14 | curl | 7.88.1-10 | DEBIAN-CVE-2023-28321 |
| Rocky Linux:8 | curl | 0:7.61.1-30.el8_8.3 | RLSA-2023:4523 |
| Ubuntu:22.04:LTS | curl | 7.81.0-1ubuntu1.11 | UBUNTU-CVE-2023-28321 |
| Ubuntu:22.04:LTS | curl | 7.81.0-1ubuntu1.11 | USN-6237-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | https://github.com/curl/curl | Fixed in 8.1.0 |
Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
References
- https://hackerone.com/reports/1950627
- FEDORA-2023-37eac50e9b vendor-advisory
- FEDORA-2023-8ed627bb04 vendor-advisory
- https://security.netapp.com/advisory/ntap-20230609-0009/
- https://support.apple.com/kb/HT213843
- https://support.apple.com/kb/HT213844
- https://support.apple.com/kb/HT213845
- 20230725 APPLE-SA-2023-07-24-6 macOS Big Sur 11.7.9 mailing-list
- 20230725 APPLE-SA-2023-07-24-5 macOS Monterey 12.6.8 mailing-list
- 20230725 APPLE-SA-2023-07-24-4 macOS Ventura 13.5 mailing-list
- GLSA-202310-12 vendor-advisory
- [debian-lts-announce] 20231011 [SECURITY] [DLA 3613-1] curl security update mailing-list