CVE-2013-4545

cURL and libcurl 7.18.0 through 7.32.0, when built with OpenSSL, disables the certificate CN and SAN name field verification (CURLOPT_SSL_VERIFYHOST) when the digital signature verification (CURLOPT_SSL_VERIFYPEER) is disabled, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Affected Software

Name	Vendor	Start Version	End Version
Curl	Haxx	7.18.0 (including)	7.18.0 (including)
Curl	Haxx	7.18.1 (including)	7.18.1 (including)
Curl	Haxx	7.18.2 (including)	7.18.2 (including)
Curl	Haxx	7.19.0 (including)	7.19.0 (including)
Curl	Haxx	7.19.1 (including)	7.19.1 (including)
Curl	Haxx	7.19.2 (including)	7.19.2 (including)
Curl	Haxx	7.19.3 (including)	7.19.3 (including)
Curl	Haxx	7.19.4 (including)	7.19.4 (including)
Curl	Haxx	7.19.5 (including)	7.19.5 (including)
Curl	Haxx	7.19.6 (including)	7.19.6 (including)
Curl	Haxx	7.19.7 (including)	7.19.7 (including)
Curl	Haxx	7.20.0 (including)	7.20.0 (including)
Curl	Haxx	7.20.1 (including)	7.20.1 (including)
Curl	Haxx	7.21.0 (including)	7.21.0 (including)
Curl	Haxx	7.21.1 (including)	7.21.1 (including)
Curl	Haxx	7.21.2 (including)	7.21.2 (including)
Curl	Haxx	7.21.3 (including)	7.21.3 (including)
Curl	Haxx	7.21.4 (including)	7.21.4 (including)
Curl	Haxx	7.21.5 (including)	7.21.5 (including)
Curl	Haxx	7.21.6 (including)	7.21.6 (including)
Curl	Haxx	7.21.7 (including)	7.21.7 (including)
Curl	Haxx	7.22.0 (including)	7.22.0 (including)
Curl	Haxx	7.23.0 (including)	7.23.0 (including)
Curl	Haxx	7.23.1 (including)	7.23.1 (including)
Curl	Haxx	7.24.0 (including)	7.24.0 (including)
Curl	Haxx	7.25.0 (including)	7.25.0 (including)
Curl	Haxx	7.26.0 (including)	7.26.0 (including)
Curl	Haxx	7.27.0 (including)	7.27.0 (including)
Curl	Haxx	7.28.0 (including)	7.28.0 (including)
Curl	Haxx	7.28.1 (including)	7.28.1 (including)
Curl	Haxx	7.29.0 (including)	7.29.0 (including)
Curl	Haxx	7.30.0 (including)	7.30.0 (including)
Curl	Haxx	7.31.0 (including)	7.31.0 (including)
Curl	Haxx	7.32.0 (including)	7.32.0 (including)
Curl	Ubuntu	lucid	*
Curl	Ubuntu	precise	*
Curl	Ubuntu	quantal	*
Curl	Ubuntu	raring	*
Curl	Ubuntu	saucy	*
Curl	Ubuntu	upstream	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2013-4545
CWE	https://cwe.mitre.org/data/definitions/310.html

Affected Software

References