Поиск уязвимостей
Количество 9
Количество 9
BDU:2025-10233
Уязвимость библиотеки libcurl, связанная с ошибками процедуры подтверждения подлинности сертификата, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
ALT-PU-2025-7807
ALT-PU-2025-7807: package `curl` update to version 8.14.1-alt1
CVE-2025-5025
libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing.
CVE-2025-5025
libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing.
CVE-2025-5025
libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing.
CVE-2025-5025
No QUIC certificate pinning with wolfSSL
CVE-2025-5025
libcurl supports *pinning* of the server certificate public key for HT ...
GHSA-x8ch-h5vv-q6cm
libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing.
SUSE-SU-2025:03198-1
Security update for curl
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | BDU:2025-10233 Уязвимость библиотеки libcurl, связанная с ошибками процедуры подтверждения подлинности сертификата, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации | CVSS3: 5.4 | 0% Низкий | больше 1 года назад |
| ALT-PU-2025-7807 ALT-PU-2025-7807: package `curl` update to version 8.14.1-alt1 | CVSS3: 7.5 | больше 1 года назад | |
 | CVE-2025-5025 libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing. | CVSS3: 4.8 | 0% Низкий | больше 1 года назад |
 | CVE-2025-5025 libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing. | CVSS3: 4.8 | 0% Низкий | больше 1 года назад |
 | CVE-2025-5025 libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing. | CVSS3: 4.8 | 0% Низкий | больше 1 года назад |
 | CVE-2025-5025 No QUIC certificate pinning with wolfSSL | CVSS3: 4.8 | 0% Низкий | 3 месяца назад |
| CVE-2025-5025 libcurl supports *pinning* of the server certificate public key for HT ... | CVSS3: 4.8 | 0% Низкий | больше 1 года назад |
| GHSA-x8ch-h5vv-q6cm libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing. | CVSS3: 4.8 | 0% Низкий | больше 1 года назад |
 | SUSE-SU-2025:03198-1 Security update for curl | около 1 года назад |
Уязвимостей на страницу