Wind River Support Network

HomeDefectsLIN5-9200
Fixed

LIN5-9200 : Security Advisory - curl - CVE-2013-6422

Created: Jan 5, 2014    Updated: Dec 19, 2017
Resolved Date: Jan 22, 2014
Found In Version: 5.0.1.12
Fix Version: 5.0.1.12
Severity: Standard
Applicable for: Wind River Linux 5
Component/s: Userspace

Description

The GnuTLS backend in libcurl 7.21.4 through 7.33.0, when disabling digital signature verification (CURLOPT_SSL_VERIFYPEER), also disables the CURLOPT_SSL_VERIFYHOST check for CN or SAN host name fields, which makes it easier for remote attackers to spoof servers and conduct man-in-the-middle (MITM) attacks.

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-6422

Other Downloads


Live chat
Online