Описание
libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks.
A vulnerability was found in curl. When using WolfSSL as the TLS library, it skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. This can result in curl being unable to detect illegitimate servers or man-in-the-middle attacks, potentially leading to unauthorized connections to malicious hosts or the interception of sensitive communications.
This issue only affects instances of curl and libcurl using WolfSSL as the backend TLS library.
Отчет
This vulnerability doesn't impact any Red Hat supported curl versions, as Red Hat doesn't ship WolfSSL TLS library in any product.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Confidential Compute Attestation | confidential-compute-attestation-tech-preview/trustee-rhel9 | Not affected | ||
| Red Hat Enterprise Linux 10 | curl | Not affected | ||
| Red Hat Enterprise Linux 10 | rust | Not affected | ||
| Red Hat Enterprise Linux 10 | snphost | Not affected | ||
| Red Hat Enterprise Linux 10 | trustee-guest-components | Not affected | ||
| Red Hat Enterprise Linux 6 | curl | Not affected | ||
| Red Hat Enterprise Linux 7 | curl | Not affected | ||
| Red Hat Enterprise Linux 8 | curl | Not affected | ||
| Red Hat Enterprise Linux 9 | curl | Not affected | ||
| Red Hat Enterprise Linux 9 | rust | Not affected |
Показывать по
Дополнительная информация
Статус:
6.5 Medium
CVSS3
Связанные уязвимости
libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks.
libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks.
libcurl accidentally skips the certificate verification for QUIC conne ...
libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks.
6.5 Medium
CVSS3