Improper certificate validation in https://github.com/curl/curl
Priority MEDIUM 60CWE-295Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 9 fixed, 3 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-295.
Summary
An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to pattern match, but the wildcard check in curl could still check for `x*`, which would match even though the IDN name most likely contained nothing even resembling an `x`.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01806 78th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Red Hat: 6 advisoriesRed Hat: 9 fixed, 3 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | https://github.com/curl/curl | Fixed in 8.1.0 | — | No fix listed | CNA |
- https://github.com/curl/curl Vendor— Affected Fixed in 8.1.0 Fixed in — No fix listed CNA
CPE configurations NVD · 15
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* | before 8.1.0 | Vulnerable | Haxx |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | 37 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* | 38 | Vulnerable | Fedoraproject |
| cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:ontap_antivirus_connector:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
- cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* Versions before 8.1.0 Vulnerable ·Haxx
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
- cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:ontap_antivirus_connector:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
Show 5 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* | 11.0 to before 11.7.9; 12.0 to before 12.6.8; 13.0 to before 13.5 | Vulnerable | Apple |
- cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* Versions 11.0 to before 11.7.9; 12.0 to before 12.6.8; 13.0 to before 13.5 Vulnerable ·Apple
Remediation
Red Hat 6 advisories
- RHSA-2023:6292 Released 2023-11-02 · Red Hat rating Moderatecurl security update
- Red Hat Enterprise Linux BaseOS EUS (v.8.6) curl-7.61.1-22.el8_6.9, libcurl-7.61.1-22.el8_6.9, libcurl-devel-7.61.1-22.el8_6.9 +1
- RHSA-2023:5598 Released 2023-10-10 · Red Hat rating Moderatecurl security update
- Red Hat Enterprise Linux AppStream EUS (v.9.0) libcurl-devel-7.76.1-14.el9_0.7
- Red Hat Enterprise Linux BaseOS EUS (v.9.0) curl-7.76.1-14.el9_0.7, curl-minimal-7.76.1-14.el9_0.7, libcurl-7.76.1-14.el9_0.7 +1
- RHSA-2023:4629 Released 2023-08-15 · Red Hat rating ModerateRed Hat JBoss Core Services Apache HTTP Server 2.4.57 security update
- Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-apr-1.7.0-8.el7jbcs, jbcs-httpd24-apr-devel-1.7.0-8.el7jbcs, jbcs-httpd24-curl-8.2.1-1.el7jbcs +12
- Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-apr-1.7.0-8.el8jbcs, jbcs-httpd24-apr-devel-1.7.0-8.el8jbcs, jbcs-httpd24-curl-8.2.1-1.el8jbcs +12
Show 3 more Red Hat advisories
- RHSA-2023:4628 Released 2023-08-15 · Red Hat rating ModerateRed Hat JBoss Core Services Apache HTTP Server 2.4.57 security update
- Red Hat JBoss Core Services 2.4.57
- RHSA-2023:4523 Released 2023-08-08 · Red Hat rating Moderatecurl security update
- Red Hat Enterprise Linux BaseOS (v. 8) curl-7.61.1-30.el8_8.3, libcurl-7.61.1-30.el8_8.3, libcurl-devel-7.61.1-30.el8_8.3 +1
- RHSA-2023:4354 Released 2023-08-01 · Red Hat rating Moderatecurl security update
- Red Hat Enterprise Linux AppStream (v. 9) libcurl-devel-7.76.1-23.el9_2.2
- Red Hat Enterprise Linux BaseOS (v. 9) curl-7.76.1-23.el9_2.2, curl-minimal-7.76.1-23.el9_2.2, libcurl-7.76.1-23.el9_2.2 +1
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
https://github.com/curl/curl — FEDORA-2023-37eac50e9b
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2023-12870 Information disclosure in https://github.com/curl/curlPriority MEDIUM 63
- Advisory ·
https://github.com/curl/curl — FEDORA-2023-8ed627bb04
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2023-12870 Information disclosure in https://github.com/curl/curlPriority MEDIUM 63
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| .NET Core 3.1 on Red Hat Enterprise Linux | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2023:4354 |
| Red Hat Enterprise Linux AppStream EUS (v.9.0) | Fixed | RHSA-2023:5598 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2023:4523 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2023:4354 |
| Red Hat Enterprise Linux BaseOS EUS (v.8.6) | Fixed | RHSA-2023:6292 |
| Red Hat Enterprise Linux BaseOS EUS (v.9.0) | Fixed | RHSA-2023:5598 |
| Red Hat JBoss Core Services 2.4.57 | Fixed | RHSA-2023:4628 |
| Red Hat JBoss Core Services on RHEL 7 Server | Fixed | RHSA-2023:4629 |
| Red Hat JBoss Core Services on RHEL 8 | Fixed | RHSA-2023:4629 |
Not affected: 2 products
- Red Hat JBoss Core Services on RHEL 7 Server
- Red Hat JBoss Core Services on RHEL 8
Timeline
- 2026-10-02 Threatist record created from CVE-2023-28321
- 2026-10-03 Alias added: GHSA-pgq4-vq29-6v5r
- 2026-10-09 Fix available: RHSA-2023:4628 · Red Hat
- 2026-10-31 Fix available: Red Hat JBoss Core Services 2.4.57 · Red Hat
References
Advisory 11
- FEDORA-2023-37eac50e9b
- FEDORA-2023-8ed627bb04
- https://security.netapp.com/advisory/ntap-20230609-0009/
- https://support.apple.com/kb/HT213843
- https://support.apple.com/kb/HT213844
- https://support.apple.com/kb/HT213845
- 20230725 APPLE-SA-2023-07-24-6 macOS Big Sur 11.7.9
- 20230725 APPLE-SA-2023-07-24-5 macOS Monterey 12.6.8
- 20230725 APPLE-SA-2023-07-24-4 macOS Ventura 13.5
- GLSA-202310-12
- [debian-lts-announce] 20231011 [SECURITY] [DLA 3613-1] curl security update
Sources
- CVE-2023-28321 · CVE Program
- CVE-2023-28321 · NVD
- FIRST EPSS
- GHSA-pgq4-vq29-6v5r · GitHub Advisory Database · CC BY 4.0
- CVE-2023-28321 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences