curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets. When using a HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived from the remote server and then wrongly "short-cut" the host handshake. When confusing the tickets, a HTTPS proxy can trick libcurl to use the wrong session ticket resume for the host and thereby circumvent the server TLS certificate check and make a MITM attack to be possible to perform unnoticed. Note that such a malicious HTTPS proxy needs to provide a certificate that curl will accept for the MITMed server for an attack to work - unless curl has been told to ignore the server certificate check.
curl versiones 7.63.0 hasta 7.75.0 incluyéndola, incluye una vulnerabilidad que permite que un proxy HTTPS malicioso acceda a una conexión MITM debido al manejo inapropiado de los tickets de sesión de TLS versión 1.3. Cuando se usa un proxy HTTPS y TLS 1.3, libcurl puede confundir los tickets de sesión que llegan del proxy HTTPS pero funciona como si llegaran del servidor remoto y luego "short-cut" incorrectamente el protocolo de enlace del host. Al confundir los tickets, un proxy HTTPS puede engañar a libcurl para que utilice la reanudación del ticket de sesión incorrecta para el host y, por lo tanto, omitir la verificación del certificado TLS del servidor y hacer que un ataque MITM sea posible de realizar sin ser detectado. Tome en cuenta que dicho proxy HTTPS malicioso debe proporcionar un certificado que curl aceptará para el servidor MITMed para que funcione un ataque, a menos que se le haya dicho a curl que ignore la verificación del certificado del servidor.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | HIGH |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | LOW |
| Availability Impact | NONE |
AV:N/AC:M/Au:N/C:N/I:P/A:N
| Access Vector | NETWORK |
|---|---|
| Access Complexity | MEDIUM |
| Authentication | NONE |
| Confidentiality Impact | NONE |
| Integrity Impact | PARTIAL |
| Availability Impact | NONE |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-300
|
| [email protected] | Primary |
en
CWE-290
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| haxx | libcurl | * | <built-in method update of dict object at 0x7fd385615740> | Application |
| fedoraproject | fedora | 32 | <built-in method update of dict object at 0x7fd340a92840> | Operating System |
| fedoraproject | fedora | 33 | <built-in method update of dict object at 0x7fd2a159e080> | Operating System |
| fedoraproject | fedora | 34 | <built-in method update of dict object at 0x7fd384e99980> | Operating System |
| netapp | hci_management_node | - | <built-in method update of dict object at 0x7fd2dbe0e5c0> | Application |
| netapp | solidfire | - | <built-in method update of dict object at 0x7fd2dbe0dd40> | Application |
| netapp | hci_storage_node | - | <built-in method update of dict object at 0x7fd3606ca300> | Hardware |
| broadcom | fabric_operating_system | - | <built-in method update of dict object at 0x7fd3606cb680> | Operating System |
| debian | debian_linux | 9.0 | <built-in method update of dict object at 0x7fd2dbe0f140> | Operating System |
| siemens | sinec_infrastructure_network_services | * | <built-in method update of dict object at 0x7fd2dbe0cfc0> | Application |
| oracle | communications_billing_and_revenue_management | 12.0.0.3.0 | <built-in method update of dict object at 0x7fd340b02780> | Application |
| oracle | essbase | 21.2 | <built-in method update of dict object at 0x7fd37038dec0> | Application |
| splunk | universal_forwarder | * | <built-in method update of dict object at 0x7fd39c46c180> | Application |
| splunk | universal_forwarder | * | <built-in method update of dict object at 0x7fd39c4a5380> | Application |
| splunk | universal_forwarder | 9.1.0 | <built-in method update of dict object at 0x7fd36ad7f740> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:haxx:libcurl:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:h:netapp:hci_storage_node:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:broadcom:fabric_operating_system:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:essbase:21.2:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:* |