CVE-2023-28321
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2023-28321
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to pattern match, but the wildcard check in curl could still check for `x*`, which would match even though the IDN name most likely contained nothing even resembling an `x`.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
证书验证不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
curl 信任管理问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
curl是一款用于从服务器传输数据或向服务器传输数据的工具。 curl 存在安全漏洞，该漏洞源于IDN 通配符匹配可能导致不正确的证书验证。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | https://github.com/curl/curl | Fixed in 8.1.0 | - |
II. Public POCs for CVE-2023-28321
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-28321
请登录查看更多情报信息。
- https://security.gentoo.org/glsa/202310-12vendor-advisory
- http://seclists.org/fulldisclosure/2023/Jul/47mailing-list
- http://seclists.org/fulldisclosure/2023/Jul/52mailing-list
- http://seclists.org/fulldisclosure/2023/Jul/48mailing-list
- https://nvd.nist.gov/vuln/detail/CVE-2023-28321
Same Patch Batch · n/a · 2023-05-26 · 26 CVEs total
| CVE-2022-46945 | 9.1 CRITICAL | NagVis 路径遍历漏洞 |
| CVE-2023-2283 | libssh 授权问题漏洞 | |
| CVE-2023-27311 | NetApp BlueXP Cloud 路径遍历漏洞 | |
| CVE-2023-2898 | Linux kernel 代码问题漏洞 | |
| CVE-2023-33247 | Talend Data Catalog 安全漏洞 | |
| CVE-2023-33255 | Papaya 跨站脚本漏洞 | |
| CVE-2023-28319 | libcurl 资源管理错误漏洞 | |
| CVE-2023-28320 | libcurl 资源管理错误漏洞 | |
| CVE-2023-28322 | libcurl 安全漏洞 | |
| CVE-2023-1664 | Red Hat Keycloak 信任管理问题漏洞 | |
| CVE-2023-1667 | libssh 代码问题漏洞 | |
| CVE-2023-1981 | Avahi 资源管理错误漏洞 | |
| CVE-2023-20868 | Vmware NSX-T 跨站脚本漏洞 | |
| CVE-2023-22970 | Bottle 安全漏洞 | |
| CVE-2023-33394 | skycaiji 跨站脚本漏洞 | |
| CVE-2023-33439 | Faculty Evaluation System SQL注入漏洞 | |
| CVE-2023-33440 | Faculty Evaluation System 安全漏洞 | |
| CVE-2023-33720 | MP4v2 资源管理错误漏洞 | |
| CVE-2023-20882 | Cloud Foundry 安全漏洞 | |
| CVE-2023-20883 | Spring Framework 资源管理错误漏洞 |
Showing top 20 of 26 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: n/a
- CVE-2026-8276
bettercap MySQL Server mysql_server.go integer coercion - CVE-2026-8275
bettercap zerogod IPP Service zerogod_ipp_primitives.go ippR - CVE-2026-8270
Open5GS SMF ogs_nas_parse_qos_rules denial of service - CVE-2026-8269
Open5GS SMF smf_nsmf_handle_create_sm_context denial of serv - CVE-2026-8268
Open5GS SMF OpenAPI_list_create denial of service
Same weakness: CWE-295
V. Comments for CVE-2023-28321
No comments yet