[<prev] [next>] [day] [month] [year] [list]
Message-ID: <op4002s1-24o9-os40-7ps4-o41pqp7qr0q7@unkk.fr>
Date: Wed, 28 May 2025 07:49:41 +0200 (CEST)
From: Daniel Stenberg <daniel@...x.se>
To: curl security announcements -- curl users <curl-users@...ts.haxx.se>,
curl-announce@...ts.haxx.se, libcurl hacking <curl-library@...ts.haxx.se>,
oss-security@...ts.openwall.com
Subject: [SECURITY ADVISORY] curl: QUIC certificate check skip with wolfSSL
QUIC certificate check skip with wolfSSL
========================================
Project curl Security Advisory, May 28 2025 -
[Permalink](https://curl.se/docs/CVE-2025-4947.html)
VULNERABILITY
-------------
libcurl accidentally skips the certificate verification for QUIC connections
when connecting to a host specified as an IP address in the URL. Therefore, it
does not detect impostors or man-in-the-middle attacks.
INFO
----
curl can get built to use one out of twelve different TLS libraries. The
selection is done both at build-time and also optionallt at run-time. This
vulnerability only affects curl made to use this specific TLS backend.
This flaw requires wolfSSL to be used as the TLS backend for QUIC to trigger.
The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2025-4947 to this issue.
CWE-295: Improper Certificate Validation
Severity: Medium
AFFECTED VERSIONS
-----------------
- Affected versions: curl 8.8.0 to and including 8.13.0
- Not affected versions: curl < 8.8.0 and >= 8.14.0
- Introduced-in: https://github.com/curl/curl/commit/4c46e277b2a0c0489
Beware that while curl versions before 8.8.0 are not considered vulnerable to
this flaw, certificate verification still did not work correctly then and was
documented to not work.
libcurl is used by many applications, but not always advertised as such!
This bug is **not** considered a *C mistake*. It is not likely to have been
avoided had we not been using C.
This flaw also affects the curl command line tool.
SOLUTION
------------
Starting in curl 8.14.0, this mistake is fixed.
- Fixed-in: https://github.com/curl/curl/commit/a85f1df4803bbd272905c9e7125
RECOMMENDATIONS
--------------
A - Upgrade curl to version 8.14.0
B - Apply the patch to your local version
C - Avoid using HTTP/3 with curl built to use wolfSSL
TIMELINE
--------
This issue was reported to the curl project on May 17, 2025. We contacted
distros@...nwall on May 20, 2025.
curl 8.14.0 was released on May 28 2025 around 07:00 UTC, coordinated with the
publication of this advisory.
The curl security team is not aware of any active exploits using this
vulnerability.
CREDITS
-------
- Reported-by: Hiroki Kurosawa
- Patched-by: Stefan Eissing
Thanks a lot!
--
/ daniel.haxx.se || https://rock-solid.curl.dev
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
