CVE-2023-28321

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-28321
An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to pattern match, but the wildcard check in curl could still check for `x*`, which would match even though the IDN name most likely contained nothing even resembling an `x`.

5.9 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
http://seclists.org/fulldisclosure/2023/Jul/47 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2023/Jul/48 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2023/Jul/52 Mailing List Third Party Advisory
https://hackerone.com/reports/1950627 Exploit Patch Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/10/msg00016.html Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F4I75RDGX5ULSSCBE5BF3P5I5SFO7ULQ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z2LIWHWKOVH24COGGBCVOWDXXIUPKOMK/
https://security.gentoo.org/glsa/202310-12 Third Party Advisory
https://security.netapp.com/advisory/ntap-20230609-0009/ Third Party Advisory
https://support.apple.com/kb/HT213843 Third Party Advisory
https://support.apple.com/kb/HT213844 Third Party Advisory
https://support.apple.com/kb/HT213845 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:ontap_antivirus_connector:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*

Configuration 8 (hide)

OR cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
History

07 Nov 2023, 04:10

Type Values Removed Values Added
References
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z2LIWHWKOVH24COGGBCVOWDXXIUPKOMK/', 'name': 'FEDORA-2023-8ed627bb04', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'FEDORA'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F4I75RDGX5ULSSCBE5BF3P5I5SFO7ULQ/', 'name': 'FEDORA-2023-37eac50e9b', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'FEDORA'}
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z2LIWHWKOVH24COGGBCVOWDXXIUPKOMK/ -
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F4I75RDGX5ULSSCBE5BF3P5I5SFO7ULQ/ -

20 Oct 2023, 18:42

Type Values Removed Values Added
First Time Debian debian Linux
Debian
CPE cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
References (MLIST) https://lists.debian.org/debian-lts-announce/2023/10/msg00016.html - (MLIST) https://lists.debian.org/debian-lts-announce/2023/10/msg00016.html - Mailing List, Third Party Advisory
References (GENTOO) https://security.gentoo.org/glsa/202310-12 - (GENTOO) https://security.gentoo.org/glsa/202310-12 - Third Party Advisory
References (FULLDISC) http://seclists.org/fulldisclosure/2023/Jul/47 - Mailing List (FULLDISC) http://seclists.org/fulldisclosure/2023/Jul/47 - Mailing List, Third Party Advisory
References (FULLDISC) http://seclists.org/fulldisclosure/2023/Jul/48 - Mailing List (FULLDISC) http://seclists.org/fulldisclosure/2023/Jul/48 - Mailing List, Third Party Advisory
References (FULLDISC) http://seclists.org/fulldisclosure/2023/Jul/52 - Mailing List (FULLDISC) http://seclists.org/fulldisclosure/2023/Jul/52 - Mailing List, Third Party Advisory

11 Oct 2023, 15:15

Type Values Removed Values Added
References
  • (MLIST) https://lists.debian.org/debian-lts-announce/2023/10/msg00016.html -

11 Oct 2023, 11:15

Type Values Removed Values Added
References
  • (GENTOO) https://security.gentoo.org/glsa/202310-12 -

02 Aug 2023, 16:46

Type Values Removed Values Added
CPE cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:ontap_antivirus_connector:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*
References (CONFIRM) https://support.apple.com/kb/HT213843 - (CONFIRM) https://support.apple.com/kb/HT213843 - Third Party Advisory
References (CONFIRM) https://support.apple.com/kb/HT213844 - (CONFIRM) https://support.apple.com/kb/HT213844 - Third Party Advisory
References (FULLDISC) http://seclists.org/fulldisclosure/2023/Jul/52 - (FULLDISC) http://seclists.org/fulldisclosure/2023/Jul/52 - Mailing List
References (FULLDISC) http://seclists.org/fulldisclosure/2023/Jul/47 - (FULLDISC) http://seclists.org/fulldisclosure/2023/Jul/47 - Mailing List
References (CONFIRM) https://support.apple.com/kb/HT213845 - (CONFIRM) https://support.apple.com/kb/HT213845 - Third Party Advisory
References (FULLDISC) http://seclists.org/fulldisclosure/2023/Jul/48 - (FULLDISC) http://seclists.org/fulldisclosure/2023/Jul/48 - Mailing List
First Time Netapp h700s
Netapp ontap Antivirus Connector
Netapp clustered Data Ontap
Netapp h700s Firmware
Netapp h300s
Apple
Apple macos
Netapp h300s Firmware
Netapp h410s
Netapp h410s Firmware
Netapp h500s Firmware
Netapp
Netapp h500s

25 Jul 2023, 16:15

Type Values Removed Values Added
References
  • (FULLDISC) http://seclists.org/fulldisclosure/2023/Jul/47 -
  • (FULLDISC) http://seclists.org/fulldisclosure/2023/Jul/48 -
  • (FULLDISC) http://seclists.org/fulldisclosure/2023/Jul/52 -

24 Jul 2023, 19:15

Type Values Removed Values Added
References
  • (CONFIRM) https://support.apple.com/kb/HT213845 -
  • (CONFIRM) https://support.apple.com/kb/HT213844 -
  • (CONFIRM) https://support.apple.com/kb/HT213843 -

16 Jun 2023, 19:17

Type Values Removed Values Added
References (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z2LIWHWKOVH24COGGBCVOWDXXIUPKOMK/ - (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z2LIWHWKOVH24COGGBCVOWDXXIUPKOMK/ - Mailing List, Third Party Advisory
References (CONFIRM) https://security.netapp.com/advisory/ntap-20230609-0009/ - (CONFIRM) https://security.netapp.com/advisory/ntap-20230609-0009/ - Third Party Advisory
References (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F4I75RDGX5ULSSCBE5BF3P5I5SFO7ULQ/ - (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F4I75RDGX5ULSSCBE5BF3P5I5SFO7ULQ/ - Mailing List, Third Party Advisory
CPE cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
First Time Fedoraproject
Fedoraproject fedora
CVSS v2 : unknown
v3 : 7.5 		v2 : unknown
v3 : 5.9

09 Jun 2023, 08:15

Type Values Removed Values Added
References
  • (CONFIRM) https://security.netapp.com/advisory/ntap-20230609-0009/ -

08 Jun 2023, 04:15

Type Values Removed Values Added
References
  • (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z2LIWHWKOVH24COGGBCVOWDXXIUPKOMK/ -

07 Jun 2023, 04:15

Type Values Removed Values Added
References
  • (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F4I75RDGX5ULSSCBE5BF3P5I5SFO7ULQ/ -

02 Jun 2023, 18:23

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
CWE CWE-295
References (MISC) https://hackerone.com/reports/1950627 - (MISC) https://hackerone.com/reports/1950627 - Exploit, Patch, Third Party Advisory
First Time Haxx
Haxx curl
CPE cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*

26 May 2023, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-05-26 21:15

Updated : 2023-12-10 15:01

NVD link : CVE-2023-28321

Mitre link : CVE-2023-28321

CVE.ORG link : CVE-2023-28321

JSON object : View

Products Affected

netapp

  • h300s_firmware
  • h500s_firmware
  • h410s_firmware
  • clustered_data_ontap
  • ontap_antivirus_connector
  • h700s_firmware
  • h700s
  • h500s
  • h410s
  • h300s

fedoraproject

  • fedora

apple

  • macos

haxx

  • curl

debian

  • debian_linux
CWE
CWE-295

Improper Certificate Validation