CVE-2013-4545 - MitM attack/spoof
Bug #1257872 reported by
Ray Link
This bug affects 1 person
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| curl (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned | ||
| Lucid |
Fix Released
|
Low
|
Marc Deslauriers | ||
| Precise |
Fix Released
|
Low
|
Marc Deslauriers | ||
| Quantal |
Fix Released
|
Low
|
Marc Deslauriers | ||
| Raring |
Fix Released
|
Low
|
Marc Deslauriers | ||
| Saucy |
Fix Released
|
Low
|
Marc Deslauriers | ||
Bug Description
http://
From CVE report:
----------
cURL and libcurl 7.18.0 through 7.32.0, when built with OpenSSL, disables the certificate CN and SAN name field verification (CURLOPT_
----------
From developer: http://
Debian security advisory: http://
Patch (same fix as upstream and Debian) against 7.22.0-3ubuntu4.3 (current Precise) attached.
CVE References
Revision history for this message
| Ray Link (rlink) wrote | #1 |
| information type: | Private Security → Public Security |
| description: | updated |
Revision history for this message
| Luke Faraone (lfaraone) wrote | #2 |
| tags: | added: patch |
| Changed in curl (Ubuntu): | |
| status: | New → Fix Released |
Revision history for this message
| Marc Deslauriers (mdeslaur) wrote | #3 |
| Changed in curl (Ubuntu Lucid): | |
| status: | New → Confirmed |
| importance: | Undecided → Low |
| status: | Confirmed → In Progress |
| assignee: | nobody → Marc Deslauriers (mdeslaur) |
| Changed in curl (Ubuntu Precise): | |
| status: | New → In Progress |
| importance: | Undecided → Low |
| assignee: | nobody → Marc Deslauriers (mdeslaur) |
| Changed in curl (Ubuntu Quantal): | |
| status: | New → In Progress |
| Changed in curl (Ubuntu Raring): | |
| status: | New → In Progress |
| Changed in curl (Ubuntu Saucy): | |
| status: | New → In Progress |
| Changed in curl (Ubuntu Quantal): | |
| importance: | Undecided → Low |
| assignee: | nobody → Marc Deslauriers (mdeslaur) |
| Changed in curl (Ubuntu Raring): | |
| importance: | Undecided → Low |
| assignee: | nobody → Marc Deslauriers (mdeslaur) |
| Changed in curl (Ubuntu Saucy): | |
| importance: | Undecided → Low |
| assignee: | nobody → Marc Deslauriers (mdeslaur) |
| Changed in curl (Ubuntu Lucid): | |
| status: | In Progress → Fix Released |
| Changed in curl (Ubuntu Precise): | |
| status: | In Progress → Fix Released |
| Changed in curl (Ubuntu Quantal): | |
| status: | In Progress → Fix Released |
| Changed in curl (Ubuntu Raring): | |
| status: | In Progress → Fix Released |
| Changed in curl (Ubuntu Saucy): | |
| status: | In Progress → Fix Released |
To post a comment you must log in.
Debian fixed this in 7.33.0-1 , and we have 7.33.0-1ubuntu1 in trusty.