Vulnerability Details : CVE-2007-3564
libcurl 7.14.0 through 7.16.3, when built with GnuTLS support, does not check SSL/TLS certificate expiration or activation dates, which allows remote attackers to bypass certain access restrictions.
Exploit prediction scoring system (EPSS) score for CVE-2007-3564
Probability of exploitation activity in the next 30 days: 1.81%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 88 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2007-3564
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST |
Vendor statements for CVE-2007-3564
-
Red Hat 2007-07-20Not vulnerable. The curl packages as shipped with Red Hat Enterprise Linux versions 2.1, 3, 4 and 5 are not linked against the gnutls library.
-
http://www.curl.haxx.se/docs/adv_20070710.html
Patch;Vendor Advisory
-
http://www.vupen.com/english/advisories/2007/2551
-
http://www.securityfocus.com/bid/24938
-
http://www.ubuntu.com/usn/usn-484-1
Patch
-
http://www.trustix.org/errata/2007/0023/
Trustix | Empowering Trust and Security in the Digital Age
-
http://www.debian.org/security/2007/dsa-1333
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/35479
- cpe:2.3:a:libcurl:libcurl:7.15.2:*:*:*:*:*:*:*
- cpe:2.3:a:libcurl:libcurl:7.15.3:*:*:*:*:*:*:*
- cpe:2.3:a:libcurl:libcurl:7.15:*:*:*:*:*:*:*
- cpe:2.3:a:libcurl:libcurl:7.15.1:*:*:*:*:*:*:*
- cpe:2.3:a:libcurl:libcurl:7.16.3:*:*:*:*:*:*:*
- cpe:2.3:a:libcurl:libcurl:7.14:*:*:*:*:*:*:*
- cpe:2.3:a:libcurl:libcurl:7.14.1:*:*:*:*:*:*:*