Unscored severity · published Aug 14, 2009
CVE-2009-2417
lib/ssluse.c in cURL and libcurl 7.4 through 7.19.5, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an…
–
CVSS
3.5%
EPSS
No
On KEV
Description
lib/ssluse.c in cURL and libcurl 7.4 through 7.19.5, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.5% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
Libcurl · Curl
7.4; 7.4.1; 7.4.2; 7.5; 7.5.1; 7.5.2; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-2417
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-2417
Patch
http://curl.haxx.se/CVE-2009-2417/curl-7.10.6-CVE-2009-2417.patch
Patch
http://curl.haxx.se/CVE-2009-2417/curl-7.11.0-CVE-2009-2417.patch
Patch
http://curl.haxx.se/CVE-2009-2417/curl-7.12.1-CVE-2009-2417.patch
Patch
http://curl.haxx.se/CVE-2009-2417/curl-7.15.1-CVE-2009-2417.patch
Patch
http://curl.haxx.se/CVE-2009-2417/curl-7.15.5-CVE-2009-2417.patch
Patch
http://curl.haxx.se/CVE-2009-2417/curl-7.16.4-CVE-2009-2417.patch
More from Libcurl
6.5
CVE-2024-2466
TLS certificate check bypass with mbedTLS
–
CVE-2012-0036
curl and libcurl 7.2x before 7.24.0 do not properly consider special characters during extraction of a pathname from a URL, which allows remote attackers to conduct data-injection…
–
CVE-2010-0734
content_encoding.c in libcurl 7.10.5 through 7.19.7, when zlib is enabled, does not properly restrict the amount of callback data sent to an application that requests automatic…
–
CVE-2009-0037
The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPT_FOLLOWLOCATION is enabled, accepts arbitrary Location values, which might allow remote HTTP…