CVE-2025-5025
CVE-2025-5025 · No QUIC certificate pinning with wolfSSL
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing.
CVSS 4.8 · Moyenne · EPSS 0,3% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: system
Produits et versions concernés
curl
- Versions du logiciel
- ≥ 8.13.0, ≤ 8.13.0: Concernée (semver)
- ≥ 8.12.1, ≤ 8.12.1: Concernée (semver)
- ≥ 8.12.0, ≤ 8.12.0: Concernée (semver)
- ≥ 8.11.1, ≤ 8.11.1: Concernée (semver)
- ≥ 8.11.0, ≤ 8.11.0: Concernée (semver)
- ≥ 8.10.1, ≤ 8.10.1: Concernée (semver)
- ≥ 8.10.0, ≤ 8.10.0: Concernée (semver)
- ≥ 8.9.1, ≤ 8.9.1: Concernée (semver)
- ≥ 8.9.0, ≤ 8.9.0: Concernée (semver)
- ≥ 8.8.0, ≤ 8.8.0: Concernée (semver)
- ≥ 8.7.1, ≤ 8.7.1: Concernée (semver)
- ≥ 8.7.0, ≤ 8.7.0: Concernée (semver)
- ≥ 8.6.0, ≤ 8.6.0: Concernée (semver)
- ≥ 8.5.0, ≤ 8.5.0: Concernée (semver)
Aucun correctif publié
curl Debian:13
- Plages de versions concernées
- ECOSYSTEM: < 8.14.0-1
Mettez à jour vers 8.14.0-1
curl Debian:14
- Plages de versions concernées
- ECOSYSTEM: < 8.14.0-1
Mettez à jour vers 8.14.0-1