Know every vulnerabilitybefore it knows you.
DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.
CURL-CVE-2016-9952
No affected components available
curl's TLS server certificate checks are flawed on Windows CE.
This vulnerability occurs in the verify certificate function when comparing a
wildcard certificate name (as returned by the Windows API function
CertGetNameString) to the hostname used to make the connection to the
server.
The vulnerability can be triggered with an overly permissive wildcard SAN in
the server certificate such as a DNS name of *.com. When the function
compares the cert name to the connection hostname, the wildcard character is
removed from the cert name and the connection hostname is checked to see if it
ends with the modified cert name. This means a hostname of example.com would
match a DNS SAN of *.com, among other variations. This approach violates
recommendations in RFC 6125 and could lead to MITM attacks.
Measures severity based on intrinsic characteristics of the vulnerability, independent of environment.
No exploitation activity has been observed at this time. Continue routine monitoring.
The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days.
We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.
Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.
Checkout DevGuard