Vulnerability Details : CVE-2007-3564
libcurl 7.14.0 through 7.16.3, when built with GnuTLS support, does not check SSL/TLS certificate expiration or activation dates, which allows remote attackers to bypass certain access restrictions.
Products affected by CVE-2007-3564
- cpe:2.3:a:libcurl:libcurl:7.15.2:*:*:*:*:*:*:*
- cpe:2.3:a:libcurl:libcurl:7.15.3:*:*:*:*:*:*:*
- cpe:2.3:a:libcurl:libcurl:7.15:*:*:*:*:*:*:*
- cpe:2.3:a:libcurl:libcurl:7.15.1:*:*:*:*:*:*:*
- cpe:2.3:a:libcurl:libcurl:7.16.3:*:*:*:*:*:*:*
- cpe:2.3:a:libcurl:libcurl:7.14:*:*:*:*:*:*:*
- cpe:2.3:a:libcurl:libcurl:7.14.1:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2007-3564
26.69%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 97 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2007-3564
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST |
Vendor statements for CVE-2007-3564
-
Red Hat 2007-07-20Not vulnerable. The curl packages as shipped with Red Hat Enterprise Linux versions 2.1, 3, 4 and 5 are not linked against the gnutls library.
References for CVE-2007-3564
-
http://www.curl.haxx.se/docs/adv_20070710.html
Patch;Vendor Advisory
-
http://www.vupen.com/english/advisories/2007/2551
Site en construction
-
http://www.securityfocus.com/bid/24938
-
http://www.ubuntu.com/usn/usn-484-1
USN-484-1: curl vulnerability | Ubuntu security notices | UbuntuPatch
-
http://www.trustix.org/errata/2007/0023/
Trustix | Empowering Trust and Security in the Digital Age
-
http://www.debian.org/security/2007/dsa-1333
[SECURITY] [DSA 1333-1] New libcurl3-gnutls packages fix certificate handling
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/35479
libcurl GnuTLS weak security CVE-2007-3564 Vulnerability Report
Jump to