VULNERABILITY INTELLIGENCE

CVE-2013-6422

CVSS score4 MEDIUM
EPSS probability2.80%
CISA KEVNot currently listed
Published2013-12-23
Last modified2026-06-17
CVSS vectorAV:N/AC:H/Au:N/C:P/I:P/A:N

Description

The GnuTLS backend in libcurl 7.21.4 through 7.33.0, when disabling digital signature verification (CURLOPT_SSL_VERIFYPEER), also disables the CURLOPT_SSL_VERIFYHOST check for CN or SAN host name fields, which makes it easier for remote attackers to spoof servers and conduct man-in-the-middle (MITM) attacks.

Weakness classification

  • CWE-20: Improper Input Validation

Primary references