A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.
Weakness
The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Curl | Haxx | 7.82.0 (including) | 8.22.0 (excluding) |
| Red Hat Hardened Images | RedHat | curl-main-8.22.0-0.1.hum1 | * |
| Red Hat Hardened Images | RedHat | rust-main-1.98.0-1.hum1 | * |
| Curl | Ubuntu | devel | * |
| Curl | Ubuntu | noble | * |
| Curl | Ubuntu | resolute | * |
| Curl | Ubuntu | upstream | * |
Extended Description
Attackers might be able to spoof the intended endpoint from a different system or process, thus gaining the same level of access as the intended endpoint. While this issue frequently involves authentication between network-based clients and servers, other types of communication channels and endpoints can have this weakness.
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/161.html
- https://cwe.mitre.org/data/definitions/481.html
- https://cwe.mitre.org/data/definitions/501.html
- https://cwe.mitre.org/data/definitions/697.html