CVE-2023-28321

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-28321
An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to pattern match, but the wildcard check in curl could still check for `x*`, which would match even though the IDN name most likely contained nothing even resembling an `x`.

5.9 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
http://seclists.org/fulldisclosure/2023/Jul/47 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2023/Jul/48 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2023/Jul/52 Mailing List Third Party Advisory
https://hackerone.com/reports/1950627 Exploit Patch Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/10/msg00016.html Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F4I75RDGX5ULSSCBE5BF3P5I5SFO7ULQ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z2LIWHWKOVH24COGGBCVOWDXXIUPKOMK/
https://security.gentoo.org/glsa/202310-12 Third Party Advisory
https://security.netapp.com/advisory/ntap-20230609-0009/ Third Party Advisory
https://support.apple.com/kb/HT213843 Third Party Advisory
https://support.apple.com/kb/HT213844 Third Party Advisory
https://support.apple.com/kb/HT213845 Third Party Advisory
http://seclists.org/fulldisclosure/2023/Jul/47 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2023/Jul/48 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2023/Jul/52 Mailing List Third Party Advisory
https://hackerone.com/reports/1950627 Exploit Patch Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/10/msg00016.html Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F4I75RDGX5ULSSCBE5BF3P5I5SFO7ULQ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z2LIWHWKOVH24COGGBCVOWDXXIUPKOMK/
https://security.gentoo.org/glsa/202310-12 Third Party Advisory
https://security.netapp.com/advisory/ntap-20230609-0009/ Third Party Advisory
https://support.apple.com/kb/HT213843 Third Party Advisory
https://support.apple.com/kb/HT213844 Third Party Advisory
https://support.apple.com/kb/HT213845 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:ontap_antivirus_connector:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*

Configuration 8 (hide)

OR cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
History

21 Nov 2024, 07:54

Type Values Removed Values Added
References () http://seclists.org/fulldisclosure/2023/Jul/47 - Mailing List, Third Party Advisory () http://seclists.org/fulldisclosure/2023/Jul/47 - Mailing List, Third Party Advisory
References () http://seclists.org/fulldisclosure/2023/Jul/48 - Mailing List, Third Party Advisory () http://seclists.org/fulldisclosure/2023/Jul/48 - Mailing List, Third Party Advisory
References () http://seclists.org/fulldisclosure/2023/Jul/52 - Mailing List, Third Party Advisory () http://seclists.org/fulldisclosure/2023/Jul/52 - Mailing List, Third Party Advisory
References () https://hackerone.com/reports/1950627 - Exploit, Patch, Third Party Advisory () https://hackerone.com/reports/1950627 - Exploit, Patch, Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2023/10/msg00016.html - Mailing List, Third Party Advisory () https://lists.debian.org/debian-lts-announce/2023/10/msg00016.html - Mailing List, Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F4I75RDGX5ULSSCBE5BF3P5I5SFO7ULQ/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F4I75RDGX5ULSSCBE5BF3P5I5SFO7ULQ/ -
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z2LIWHWKOVH24COGGBCVOWDXXIUPKOMK/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z2LIWHWKOVH24COGGBCVOWDXXIUPKOMK/ -
References () https://security.gentoo.org/glsa/202310-12 - Third Party Advisory () https://security.gentoo.org/glsa/202310-12 - Third Party Advisory
References () https://security.netapp.com/advisory/ntap-20230609-0009/ - Third Party Advisory () https://security.netapp.com/advisory/ntap-20230609-0009/ - Third Party Advisory
References () https://support.apple.com/kb/HT213843 - Third Party Advisory () https://support.apple.com/kb/HT213843 - Third Party Advisory
References () https://support.apple.com/kb/HT213844 - Third Party Advisory () https://support.apple.com/kb/HT213844 - Third Party Advisory
References () https://support.apple.com/kb/HT213845 - Third Party Advisory () https://support.apple.com/kb/HT213845 - Third Party Advisory

02 Aug 2023, 16:46

Type Values Removed Values Added
References (CONFIRM) https://support.apple.com/kb/HT213844 - (CONFIRM) https://support.apple.com/kb/HT213844 - Third Party Advisory
References (FULLDISC) http://seclists.org/fulldisclosure/2023/Jul/48 - (FULLDISC) http://seclists.org/fulldisclosure/2023/Jul/48 - Mailing List
References (FULLDISC) http://seclists.org/fulldisclosure/2023/Jul/47 - (FULLDISC) http://seclists.org/fulldisclosure/2023/Jul/47 - Mailing List
References (CONFIRM) https://support.apple.com/kb/HT213843 - (CONFIRM) https://support.apple.com/kb/HT213843 - Third Party Advisory
References (CONFIRM) https://support.apple.com/kb/HT213845 - (CONFIRM) https://support.apple.com/kb/HT213845 - Third Party Advisory
References (FULLDISC) http://seclists.org/fulldisclosure/2023/Jul/52 - (FULLDISC) http://seclists.org/fulldisclosure/2023/Jul/52 - Mailing List
CPE cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:ontap_antivirus_connector:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*

25 Jul 2023, 16:15

Type Values Removed Values Added
References
  • (FULLDISC) http://seclists.org/fulldisclosure/2023/Jul/47 -
  • (FULLDISC) http://seclists.org/fulldisclosure/2023/Jul/52 -
  • (FULLDISC) http://seclists.org/fulldisclosure/2023/Jul/48 -

24 Jul 2023, 19:15

Type Values Removed Values Added
References
  • (CONFIRM) https://support.apple.com/kb/HT213844 -
  • (CONFIRM) https://support.apple.com/kb/HT213843 -
  • (CONFIRM) https://support.apple.com/kb/HT213845 -

16 Jun 2023, 19:17

Type Values Removed Values Added
CPE cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
References (CONFIRM) https://security.netapp.com/advisory/ntap-20230609-0009/ - (CONFIRM) https://security.netapp.com/advisory/ntap-20230609-0009/ - Third Party Advisory
References (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F4I75RDGX5ULSSCBE5BF3P5I5SFO7ULQ/ - (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F4I75RDGX5ULSSCBE5BF3P5I5SFO7ULQ/ - Mailing List, Third Party Advisory
References (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z2LIWHWKOVH24COGGBCVOWDXXIUPKOMK/ - (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z2LIWHWKOVH24COGGBCVOWDXXIUPKOMK/ - Mailing List, Third Party Advisory
CVSS v2 : unknown
v3 : 7.5 		v2 : unknown
v3 : 5.9

09 Jun 2023, 08:15

Type Values Removed Values Added
References
  • (CONFIRM) https://security.netapp.com/advisory/ntap-20230609-0009/ -

08 Jun 2023, 04:15

Type Values Removed Values Added
References
  • (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z2LIWHWKOVH24COGGBCVOWDXXIUPKOMK/ -

07 Jun 2023, 04:15

Type Values Removed Values Added
References
  • (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F4I75RDGX5ULSSCBE5BF3P5I5SFO7ULQ/ -

02 Jun 2023, 18:23

Type Values Removed Values Added
CWE CWE-295
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
CPE cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*
References (MISC) https://hackerone.com/reports/1950627 - (MISC) https://hackerone.com/reports/1950627 - Exploit, Patch, Third Party Advisory

26 May 2023, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-05-26 21:15

Updated : 2024-11-21 07:54

NVD link : CVE-2023-28321

Mitre link : CVE-2023-28321

CVE.ORG link : CVE-2023-28321

JSON object : View

Products Affected

netapp

  • h300s
  • h410s
  • h500s_firmware
  • h700s
  • h700s_firmware
  • h500s
  • h410s_firmware
  • clustered_data_ontap
  • h300s_firmware
  • ontap_antivirus_connector

fedoraproject

  • fedora

debian

  • debian_linux

apple

  • macos

haxx

  • curl
CWE
CWE-295

Improper Certificate Validation