Improper Certificate Validation in cURL - CVE-2016-9952
Published: March 12, 2018 / Updated: July 28, 2020
Vulnerability identifier: #VU32181
CSH Severity: High
CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-9952
CWE-ID: CWE-295
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE using the schannel TLS backend, makes it easier for remote attackers to conduct man-in-the-middle attacks via a crafted wildcard SAN in a server certificate, as demonstrated by "*.com."
Affected software
cURL
curl (Alpine package)
curl (Alpine package)
How to mitigate CVE-2016-9952
Install update from vendor's website.
cURL - update to 7.52.0
curl (Alpine package) - update to 7.52.1-r0
curl (Alpine package) - update to 7.52.1-r0