CVE-2023-28321
published 2023-05-26CVE-2023-28321: An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject…
PriorityP433medium5.9CVSS 3.1
AVNACHPRNUINSUCNIHAN
EPSS
1.81%
75.8th percentile
An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to pattern match, but the wildcard check in curl could still check for `x*`, which would match even though the IDN name most likely contained nothing even resembling an `x`.
Affected
33 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | macos | >= 11.0 < 11.7.9 | 11.7.9 |
| apple | macos | >= 12.0 < 12.6.8 | 12.6.8 |
| apple | macos | >= 13.0 < 13.5 | 13.5 |
| apple | macos_big_sur | — | — |
| apple | macos_monterey | — | — |
| apple | macos_ventura | — | — |
| debian | curl | < curl 7.88.1-10 (bookworm) | curl 7.88.1-10 (bookworm) |
| debian | debian_linux | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| haxx | curl | < 8.1.0 | 8.1.0 |
| haxx | curl | >= 0 < 7.74.0-1.3+deb11u9 | 7.74.0-1.3+deb11u9 |
| haxx | curl | >= 0 < 7.88.1-10 | 7.88.1-10 |
| haxx | curl | >= 0 < 7.88.1-10 | 7.88.1-10 |
| haxx | curl | >= 0 < 7.88.1-10 | 7.88.1-10 |
| haxx | curl | >= 0 < 7.68.0-1ubuntu2.19 | 7.68.0-1ubuntu2.19 |
| haxx | curl | >= 0 < 7.81.0-1ubuntu1.13 | 7.81.0-1ubuntu1.13 |
| haxx | curl | >= 0 < 7.81.0-1ubuntu1.11 | 7.81.0-1ubuntu1.11 |
| haxx | curl | >= 0 < 7.35.0-1ubuntu2.20+esm16 | 7.35.0-1ubuntu2.20+esm16 |
| haxx | curl | >= 0 < 7.47.0-1ubuntu2.19+esm9 | 7.47.0-1ubuntu2.19+esm9 |
| haxx | curl | >= 0 < 7.58.0-2ubuntu3.24+esm1 | 7.58.0-2ubuntu3.24+esm1 |
| https | github.com_curl_curl | — | — |
| msrc | azl3_tensorflow_2.11.1-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_tensorflow_2.16.1-1_on_azure_linux_3.0 | — | — |
| msrc | azure_linux_3.0_arm | — | — |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
osv5.9MEDIUM
vendor_debian5.9MEDIUM
vendor_msrc5.9MEDIUM
vendor_redhat5.9MEDIUM
vendor_ubuntu5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Palo Alto
PAN-SA-2025-0012 Informational Bulletin: OSS CVEs Fixed in PAN-OS
vendor_paloalto·2025-07-09·CVSS 7.5
CVE-2018-6594 [HIGH] PAN-SA-2025-0012 Informational Bulletin: OSS CVEs Fixed in PAN-OS
PAN-SA-2025-0012 Informational Bulletin: OSS CVEs Fixed in PAN-OS
The Palo Alto Networks Product Security Assurance team has evaluated the following open source software (OSS) CVEs as they relate to PAN-OS. While it was not determined that these CVEs have any significant impact on PAN-OS, they have been fixed out of an abundance of caution. CVE Summary CVE-2018-6594 This CVE is fixed in PAN-OS 10.2.17, 11.1.11, 11.2.8, 12.1.2, and all later versions of PAN-OS CVE-2018-25032 This CVE is fixed in PAN-OS 10.1.7, 10.2.2, and all later versions of PAN-OS CVE-2019-5827 This CVE is fixed in PAN-OS 11.1.4, and all later versions of PAN-OS. CVE-2019-13750 This CVE is fixed in PAN-OS 11.1.4, and all later versions of PAN-OS. CVE-2019-13751 This CVE is fixed in PAN-OS 11.1.4, and all later versions
CISA ICS
Siemens SINEC NMS
cisa_ics·2024-02-15
Siemens SINEC NMS
ICS Advisory
##
Siemens SINEC NMS
Release DateFebruary 15, 2024
Alert CodeICSA-24-046-15
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SINEC NMS
- Vulnerabilities: Out-of-bounds Read, Inadequate Encryption Strength, Double Free, Use After Free, NULL Pointer Dereference, Improper Input Validation, Missing Encryption of Sensitive Data, Allocation of Resources Wit
Ubuntu
curl vulnerabilities
vendor_ubuntu·2023-09-11·CVSS 5.9
CVE-2023-28322 [MEDIUM] curl vulnerabilities
Title: curl vulnerabilities
Summary: Several security issues were fixed in curl.
USN-6237-1 fixed several vulnerabilities in curl. This update provides the
corresponding updates for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and
Ubuntu 18.04 LTS.
Original advisory details:
Hiroki Kurosawa discovered that curl incorrectly handled validating certain
certificate wildcards. A remote attacker could possibly use this issue to
spoof certain website certificates using IDN hosts. (CVE-2023-28321)
Hiroki Kurosawa discovered that curl incorrectly handled callbacks when
certain options are set by applications. This could cause applications
using curl to misbehave, resulting in information disclosure, or a denial
of service. (CVE-2023-28322)
It was discovered that curl incorrectly handled saving cookies
Apple
CVE-2023-28321: macOS Monterey 12.6.8
vendor_apple·2023-07-24·CVSS 5.9
CVE-2023-28321 [MEDIUM] CVE-2023-28321: macOS Monterey 12.6.8
Apple Security Update: About the security content of macOS Monterey 12.6.8
Product: macOS Monterey
Version: 12.6.8
CVE: CVE-2023-28321
Component: CVE-2023-28321
Apple
CVE-2023-28321: macOS Big Sur 11.7.9
vendor_apple·2023-07-24·CVSS 5.9
CVE-2023-28321 [MEDIUM] CVE-2023-28321: macOS Big Sur 11.7.9
Apple Security Update: About the security content of macOS Big Sur 11.7.9
Product: macOS Big Sur
Version: 11.7.9
CVE: CVE-2023-28321
Component: CVE-2023-28321
Apple
CVE-2023-28321: macOS Ventura 13.5
vendor_apple·2023-07-24·CVSS 5.9
CVE-2023-28321 [MEDIUM] CVE-2023-28321: macOS Ventura 13.5
Apple Security Update: About the security content of macOS Ventura 13.5
Product: macOS Ventura
Version: 13.5
CVE: CVE-2023-28321
Component: CVE-2023-28321
Ubuntu
curl regression
vendor_ubuntu·2023-07-19·CVSS 5.9
[MEDIUM] curl regression
Title: curl regression
Summary: USN-6237-1 introduced a regression in curl.
USN-6237-1 fixed vulnerabilities in curl. The update caused a certificate
wildcard handling regression on Ubuntu 22.04 LTS. This update fixes the
problem.
We apologize for the inconvenience.
Original advisory details:
Hiroki Kurosawa discovered that curl incorrectly handled validating certain
certificate wildcards. A remote attacker could possibly use this issue to
spoof certain website certificates using IDN hosts. (CVE-2023-28321)
Hiroki Kurosawa discovered that curl incorrectly handled callbacks when
certain options are set by applications. This could cause applications
using curl to misbehave, resulting in information disclosure, or a denial
of service. (CVE-2023-28322)
It was discovered that curl incorr
Ubuntu
curl vulnerabilities
vendor_ubuntu·2023-07-19·CVSS 5.9
CVE-2023-28321 [MEDIUM] curl vulnerabilities
Title: curl vulnerabilities
Summary: Several security issues were fixed in curl.
Hiroki Kurosawa discovered that curl incorrectly handled validating certain
certificate wildcards. A remote attacker could possibly use this issue to
spoof certain website certificates using IDN hosts. (CVE-2023-28321)
Hiroki Kurosawa discovered that curl incorrectly handled callbacks when
certain options are set by applications. This could cause applications
using curl to misbehave, resulting in information disclosure, or a denial
of service. (CVE-2023-28322)
It was discovered that curl incorrectly handled saving cookies to files. A
local attacker could possibly use this issue to create or overwrite files.
This issue only affected Ubuntu 22.10, and Ubuntu 23.04. (CVE-2023-32001)
Instructions: In general,
Red Hat
curl: IDN wildcard match may lead to Improper Cerificate Validation
vendor_redhat·2023-05-17·CVSS 5.9
CVE-2023-28321 [MEDIUM] CWE-295 curl: IDN wildcard match may lead to Improper Cerificate Validation
curl: IDN wildcard match may lead to Improper Cerificate Validation
An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to pattern match, but the wildcard check in curl could still check for `x*`, which would match even though the I
Microsoft
An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl
vendor_msrc·2023-05-09·CVSS 5.9
CVE-2023-28321 [MEDIUM] CWE-295 An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl
An improper certificate validation vulnerability exists in curl Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
hackerone: hackerone
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: htt
Debian
CVE-2023-28321: curl - An improper certificate validation vulnerability exists in curl <v8.1.0 in the w...
vendor_debian·2023·CVSS 5.9
CVE-2023-28321 [MEDIUM] CVE-2023-28321: curl - An improper certificate validation vulnerability exists in curl <v8.1.0 in the w...
An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to pattern match, but the wildcard check in curl could still check for `x*`, which would match even though the IDN name most likely contained nothing even resembling an `x`.
Scope:
OSV
curl vulnerabilities
osv·2023-09-11·CVSS 5.9
CVE-2023-28321 [MEDIUM] curl vulnerabilities
curl vulnerabilities
USN-6237-1 fixed several vulnerabilities in curl. This update provides the
corresponding updates for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and
Ubuntu 18.04 LTS.
Original advisory details:
Hiroki Kurosawa discovered that curl incorrectly handled validating certain
certificate wildcards. A remote attacker could possibly use this issue to
spoof certain website certificates using IDN hosts. (CVE-2023-28321)
Hiroki Kurosawa discovered that curl incorrectly handled callbacks when
certain options are set by applications. This could cause applications
using curl to misbehave, resulting in information disclosure, or a denial
of service. (CVE-2023-28322)
It was discovered that curl incorrectly handled saving cookies to files. A
local attacker could possibly use this issue to
OSV
curl regression
osv·2023-07-19·CVSS 5.9
CVE-2023-28321 [MEDIUM] curl regression
curl regression
USN-6237-1 fixed vulnerabilities in curl. The update caused a certificate
wildcard handling regression on Ubuntu 22.04 LTS. This update fixes the
problem.
We apologize for the inconvenience.
Original advisory details:
Hiroki Kurosawa discovered that curl incorrectly handled validating certain
certificate wildcards. A remote attacker could possibly use this issue to
spoof certain website certificates using IDN hosts. (CVE-2023-28321)
Hiroki Kurosawa discovered that curl incorrectly handled callbacks when
certain options are set by applications. This could cause applications
using curl to misbehave, resulting in information disclosure, or a denial
of service. (CVE-2023-28322)
It was discovered that curl incorrectly handled saving cookies to files. A
local attacker could
OSV
curl vulnerabilities
osv·2023-07-19·CVSS 5.9
CVE-2023-28321 [MEDIUM] curl vulnerabilities
curl vulnerabilities
Hiroki Kurosawa discovered that curl incorrectly handled validating certain
certificate wildcards. A remote attacker could possibly use this issue to
spoof certain website certificates using IDN hosts. (CVE-2023-28321)
Hiroki Kurosawa discovered that curl incorrectly handled callbacks when
certain options are set by applications. This could cause applications
using curl to misbehave, resulting in information disclosure, or a denial
of service. (CVE-2023-28322)
It was discovered that curl incorrectly handled saving cookies to files. A
local attacker could possibly use this issue to create or overwrite files.
This issue only affected Ubuntu 22.10, and Ubuntu 23.04. (CVE-2023-32001)
GHSA
GHSA-pgq4-vq29-6v5r: An improper certificate validation vulnerability exists in curl <v8
ghsa_unreviewed·2023-05-26
CVE-2023-28321 [MEDIUM] CWE-295 GHSA-pgq4-vq29-6v5r: An improper certificate validation vulnerability exists in curl <v8
An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to pattern match, but the wildcard check in curl could still check for `x*`, which would match even though the IDN name most likely contained nothing even resembling an `x`.
OSV
CVE-2023-28321: An improper certificate validation vulnerability exists in curl <v8
osv·2023-05-26·CVSS 5.9
CVE-2023-28321 [MEDIUM] CVE-2023-28321: An improper certificate validation vulnerability exists in curl <v8
An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to pattern match, but the wildcard check in curl could still check for `x*`, which would match even though the IDN name most likely contained nothing even resembling an `x`.
No detection rules found.
No public exploits indexed.
HackerOne
CVE-2023-28321: IDN wildcard match
hackerone·2023-06-25·CVSS 5.9
CVE-2023-28321 [MEDIUM] CVE-2023-28321: IDN wildcard match
CVE-2023-28321: IDN wildcard match
Original Report:https://hackerone.com/reports/1950627
## Impact
Improper Validation of Certificate with Host Mismatch.
CVE-2023-28321 - IDN wildcard match
VULNERABILITY
curl supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch.
IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with xn-- and should not be allowed to pattern match, but the wildcard check in curl could
HackerOne
CVE-2023-28321: IDN wildcard match
hackerone·2023-05-18·CVSS 5.9
CVE-2023-28321 [MEDIUM] CVE-2023-28321: IDN wildcard match
CVE-2023-28321: IDN wildcard match
## Summary:
curl /libcurl uses wildcards for validation during TLS communication, even if the hostname is an IDN.
Even if wildcards are present in the CN/SAN of the certificate, they must not be used to match if the hostname is an IDN.
This is described in [RFC-6125, section 6.4.3.][RFC]
[RFC]: https://datatracker.ietf.org/doc/html/rfc6125#section-6.4.3
You probably know that.
However, there was a problem with the implementation.
`lib/vtls/hostcheck.c` in the function 'hostmatch' on lines 100-106.
```
/* We require at least 2 dots in the pattern to avoid too wide wildcard
match. */
pattern_label_end = memchr(pattern, '.', patternlen);
if(!pattern_label_end ||
(memrchr(pattern, '.', patternlen) == pattern_label_end) ||
strncasecompare(pattern, "xn--", 4)
http://seclists.org/fulldisclosure/2023/Jul/47http://seclists.org/fulldisclosure/2023/Jul/48http://seclists.org/fulldisclosure/2023/Jul/52https://hackerone.com/reports/1950627https://lists.debian.org/debian-lts-announce/2023/10/msg00016.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F4I75RDGX5ULSSCBE5BF3P5I5SFO7ULQ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z2LIWHWKOVH24COGGBCVOWDXXIUPKOMK/https://security.gentoo.org/glsa/202310-12https://security.netapp.com/advisory/ntap-20230609-0009/https://support.apple.com/kb/HT213843https://support.apple.com/kb/HT213844https://support.apple.com/kb/HT213845http://seclists.org/fulldisclosure/2023/Jul/47http://seclists.org/fulldisclosure/2023/Jul/48http://seclists.org/fulldisclosure/2023/Jul/52https://hackerone.com/reports/1950627https://lists.debian.org/debian-lts-announce/2023/10/msg00016.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F4I75RDGX5ULSSCBE5BF3P5I5SFO7ULQ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z2LIWHWKOVH24COGGBCVOWDXXIUPKOMK/https://security.gentoo.org/glsa/202310-12https://security.netapp.com/advisory/ntap-20230609-0009/https://support.apple.com/kb/HT213843https://support.apple.com/kb/HT213844https://support.apple.com/kb/HT213845
2023-05-26
Published