libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.
libcurl omite la verificación del certificado para una conexión QUIC bajo ciertas condiciones, cuando está diseñado para usar wolfSSL. Si se le indica que utilice un cifrado o curva desconocido/incorrecto, la ruta de error omite accidentalmente la verificación y devuelve OK, ignorando así cualquier problema de certificado.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | REQUIRED |
| Scope | UNCHANGED |
| Confidentiality Impact | LOW |
| Integrity Impact | LOW |
| Availability Impact | LOW |
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Type: Secondary
Exploitability Score: 2.8
Impact Score: 3.4
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-295
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| haxx | curl | 8.6.0 | <built-in method update of dict object at 0x7fd36b155a80> | Application |
| apple | macos | * | <built-in method update of dict object at 0x7fd36b7d7440> | Operating System |
| apple | macos | * | <built-in method update of dict object at 0x7fd368d833c0> | Operating System |
| apple | macos | * | <built-in method update of dict object at 0x7fd36ad4fdc0> | Operating System |
| netapp | active_iq_unified_manager | - | <built-in method update of dict object at 0x7fd36b156600> | Application |
| netapp | ontap_select_deploy_administration_utility | - | <built-in method update of dict object at 0x7fd36b1545c0> | Application |
| netapp | h300s_firmware | - | <built-in method update of dict object at 0x7fd36ad4f6c0> | Operating System |
| netapp | h410s_firmware | - | <built-in method update of dict object at 0x7fd36b7d4bc0> | Operating System |
| netapp | h500s_firmware | - | <built-in method update of dict object at 0x7fd36aad1280> | Operating System |
| netapp | h610c_firmware | - | <built-in method update of dict object at 0x7fd36b157c00> | Operating System |
| netapp | h610s_firmware | - | <built-in method update of dict object at 0x7fd384212d40> | Operating System |
| netapp | h615c_firmware | - | <built-in method update of dict object at 0x7fd3841f3000> | Operating System |
| netapp | h700s_firmware | - | <built-in method update of dict object at 0x7fd368d83d80> | Operating System |
| netapp | bootstrap_os | - | <built-in method update of dict object at 0x7fd34b9946c0> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:haxx:curl:8.6.0:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* |
| Yes | cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h610c_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h610c:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h610s_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h610s:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h615c_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h615c:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:* |