Уязвимость некорректной проверки сертификатов в curl при проверке шаблонов с подстановочными знаками в TLS-сертификатах сервера
Описание
В программе curl присутствует уязвимость некорректной проверки сертификатов. Эта проблема возникает при использовании подстановочных знаков, указанных как "Subject Alternative Name" в TLS-сертификатах сервера. Программа curl может быть настроена на использование собственной функции сопоставления имён для TLS, вместо функции, предоставленной TLS-библиотекой. Эта внутренняя функция сопоставления подстановочных знаков некорректно обрабатывает имена, содержащие международные доменные имена (IDN), и может допускать сопоставление шаблонов, которые не должны соответствовать. IDN-имена преобразуются в puny code перед проверкой сертификаторов. Имена в puny code всегда начинаются с xn-- и не должны позволять сопоставление с шаблонами, однако функция сопоставления в curl всё ещё может проверить x*, что приведёт к совпадению, даже если IDN-имя, скорее всего, не содержит ничего похожего на x.
Затронутые версии ПО
- curl версий ниже 8.1.0
Тип уязвимости
Некорректная проверка сертификатов
Ссылки
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- ExploitPatchThird Party Advisory
- Mailing ListThird Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- ExploitPatchThird Party Advisory
- Mailing ListThird Party Advisory
- Third Party Advisory
Уязвимые конфигурации
Одно из
Одно из
Одновременно
Одновременно
Одновременно
Одновременно
Одно из
EPSS
5.9 Medium
CVSS3
Дефекты
Связанные уязвимости
An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to pattern match, but the wildcard check in curl could still check for `x*`, which would match even though the IDN name most likely contained nothing even resembling an `x`.
An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to pattern match, but the wildcard check in curl could still check for `x*`, which would match even though the IDN name most likely contained nothing even resembling an `x`.
An improper certificate validation vulnerability exists in curl <v8.1. ...
An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to pattern match, but the wildcard check in curl could still check for `x*`, which would match even though the IDN name most likely contained nothing even resembling an `x`.
EPSS
5.9 Medium
CVSS3