Vulnerability Details : CVE-2013-4545
cURL and libcurl 7.18.0 through 7.32.0, when built with OpenSSL, disables the certificate CN and SAN name field verification (CURLOPT_SSL_VERIFYHOST) when the digital signature verification (CURLOPT_SSL_VERIFYPEER) is disabled, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Exploit prediction scoring system (EPSS) score for CVE-2013-4545
Probability of exploitation activity in the next 30 days: 0.21%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 58 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2013-4545
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST |
CWE ids for CVE-2013-4545
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2013-4545
-
http://www.debian.org/security/2013/dsa-2798
Debian -- Security Information -- DSA-2798-1 curl
-
https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04463322
HP Support for Technical Help and Troubleshooting | HP® Customer Service.
-
http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html
Oracle Critical Patch Update - April 2015
-
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
Oracle Critical Patch Update - January 2015
-
http://lists.opensuse.org/opensuse-updates/2013-12/msg00053.html
openSUSE-SU-2013:1865-1: moderate: update for curl
-
http://curl.haxx.se/docs/adv_20131115.html
curl - cert name check ignore OpenSSL - CVE-2013-4545Vendor Advisory
-
http://lists.opensuse.org/opensuse-updates/2013-12/msg00047.html
openSUSE-SU-2013:1859-1: moderate: update for curl
-
http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
Oracle Critical Patch Update - July 2015
-
http://www.ubuntu.com/usn/USN-2048-1
USN-2048-1: curl vulnerability | Ubuntu security notices
Products affected by CVE-2013-4545
- cpe:2.3:a:haxx:curl:7.26.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.28.1:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.27.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.28.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.19.6:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.19.7:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.21.6:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.21.7:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.22.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.23.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.29.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.30.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.19.4:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.19.5:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.21.4:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.21.5:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.23.1:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.24.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.18.2:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.18.1:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.19.2:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.19.3:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.21.2:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.21.3:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.25.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.18.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.19.1:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.19.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.20.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.20.1:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.21.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.21.1:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.32.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.31.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.26.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.28.1:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.27.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.28.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.18.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.18.1:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.19.5:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.19.6:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.21.4:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.21.5:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.25.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.19.3:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.19.4:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.21.1:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.21.2:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.21.3:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.23.1:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.24.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.30.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.18.2:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.19.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.19.7:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.20.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.21.6:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.21.7:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.19.1:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.19.2:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.20.1:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.21.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.22.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.23.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.29.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.31.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.32.0:*:*:*:*:*:*:*