Red Hat Bugzilla – Bug 1029159
CVE-2013-4545 curl: TLS/SSL certificate name check disabled with peer verification
Last modified: 2013-12-02 04:54:31 EST
Curl upstream reported an issue related to verification of connection host name against server name specified in a TLS/SSL server certificate. When libcurl was built using OpenSSL as TLS/SSL library, setting CURLOPT_SSL_VERIFYPEER option to 0 (i.e. disabling verification that the certificate is valid and was issued by a trusted certificate authority) also disabled server name checks regardless of the value of the CURLOPT_SSL_VERIFYHOST option. This caused libcurl to skip name checks while an application using the library could expect it to be performed.
Note: Only enabling VERIFYHOST while disabling VERIFYPEER is insecure unless application performs its own peer verification equivalent to the verification performed by libcurl when VERIFYPEER is enabled.
The curl command line tool is not affected, as it disables both VERIFYPEER and VERIFYHOST when -k / --insecure command line option is used.
Documentation for VERIFYPEER and VERIFYHOST options:
This problem is a regression that was introduced in version 7.18.0. It was already corrected in version 7.33.0 released mid-October 2013.
Announcement of 7.33.0:
o OpenSSL: acknowledge CURLOPT_SSL_VERIFYHOST without VERIFYPEER
Public report of the issue on the curl-library mailing list:
Curl version shipped in Red Hat Enterprise Linux 5 is 7.15.5 and is not affected by this problem (it pre-dates the regression). Curl packages in Red Hat Enterprise Linux 6 and current Fedora versions use NSS (Network Security Services) rather than OpenSSL as TLS/SSL backend library. When VERIFYPEER is disabled in Curl versions using NSS, VERIFYHOST is automatically disabled too. Unlike OpenSSL crypto backend, this is expected and documented behavior for NSS crypto backend:
Not vulnerable. This issue did not affect the versions of curl as shipped with Red Hat Enterprise Linux 5 and 6.
Public now via upstream advisory.
mingw*-curl packages in Fedora and EPEL are based on affected upstream versions and use OpenSSL as SSL library, rather than NSS.
Created mingw32-curl tracking bugs for this issue:
Affects: epel-5 [bug 1031430]
Created mingw-curl tracking bugs for this issue:
Affects: fedora-all [bug 1031429]