CVE-2013-6422

Published: Dec 23, 2013Modified: Apr 29, 2026

4.0

Vector

AV:N/AC:H/Au:N/C:P/I:P/A:N

Exploitability: 4.9 / Impact: 4.9

Source: NVD

Description

The GnuTLS backend in libcurl 7.21.4 through 7.33.0, when disabling digital signature verification (CURLOPT_SSL_VERIFYPEER), also disables the CURLOPT_SSL_VERIFYHOST check for CN or SAN host name fields, which makes it easier for remote attackers to spoof servers and conduct man-in-the-middle (MITM) attacks.

Affected (23)

Products: Debian: Debian Linux · Canonical: Ubuntu Linux · Haxx: Libcurl

1 product

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 7.0

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 12.10
Canonical Ubuntu Linux	Version 13.04
Canonical Ubuntu Linux	Version 13.10

Configuration C

18 vulnerable

Vulnerable Software	Affected Versions
Haxx Libcurl	Version 7.21.4
Haxx Libcurl	Version 7.21.5
Haxx Libcurl	Version 7.21.6
Haxx Libcurl	Version 7.21.7
Haxx Libcurl	Version 7.22.0
Haxx Libcurl	Version 7.23.0
Haxx Libcurl	Version 7.23.1
Haxx Libcurl	Version 7.24.0
Haxx Libcurl	Version 7.25.0
Haxx Libcurl	Version 7.26.0
Haxx Libcurl	Version 7.27.0
Haxx Libcurl	Version 7.28.0
Haxx Libcurl	Version 7.28.1
Haxx Libcurl	Version 7.29.0
Haxx Libcurl	Version 7.30.0
Haxx Libcurl	Version 7.31.0
Haxx Libcurl	Version 7.32.0
Haxx Libcurl	Version 7.33.0