Buy commercial curl support. We
help you work out your issues, debug your libcurl applications, use the API,
port to new platforms, add new features and more. With a team lead by the
curl founder Daniel himself.
[SECURITY ADVISORY] curl: QUIC certificate check skip with wolfSSL
- Contemporary messages sorted: [ by date ] [ by thread ] [ by subject ] [ by author ] [ by messages with attachments ]
From: Daniel Stenberg via curl-users <curl-users_at_lists.haxx.se>
Date: Wed, 28 May 2025 07:49:41 +0200 (CEST)
QUIC certificate check skip with wolfSSL
========================================
Project curl Security Advisory, May 28 2025 -
[Permalink](https://curl.se/docs/CVE-2025-4947.html)
VULNERABILITY
-------------
libcurl accidentally skips the certificate verification for QUIC connections
when connecting to a host specified as an IP address in the URL. Therefore, it
does not detect impostors or man-in-the-middle attacks.
INFO
Date: Wed, 28 May 2025 07:49:41 +0200 (CEST)
QUIC certificate check skip with wolfSSL
========================================
Project curl Security Advisory, May 28 2025 -
[Permalink](https://curl.se/docs/CVE-2025-4947.html)
VULNERABILITY
-------------
libcurl accidentally skips the certificate verification for QUIC connections
when connecting to a host specified as an IP address in the URL. Therefore, it
does not detect impostors or man-in-the-middle attacks.
INFO
---- curl can get built to use one out of twelve different TLS libraries. The selection is done both at build-time and also optionallt at run-time. This vulnerability only affects curl made to use this specific TLS backend. This flaw requires wolfSSL to be used as the TLS backend for QUIC to trigger. The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2025-4947 to this issue. CWE-295: Improper Certificate Validation Severity: Medium AFFECTED VERSIONS ----------------- - Affected versions: curl 8.8.0 to and including 8.13.0 - Not affected versions: curl < 8.8.0 and >= 8.14.0 - Introduced-in: https://github.com/curl/curl/commit/4c46e277b2a0c0489 Beware that while curl versions before 8.8.0 are not considered vulnerable to this flaw, certificate verification still did not work correctly then and was documented to not work. libcurl is used by many applications, but not always advertised as such! This bug is **not** considered a *C mistake*. It is not likely to have been avoided had we not been using C. This flaw also affects the curl command line tool. SOLUTION ------------ Starting in curl 8.14.0, this mistake is fixed. - Fixed-in: https://github.com/curl/curl/commit/a85f1df4803bbd272905c9e7125 RECOMMENDATIONS -------------- A - Upgrade curl to version 8.14.0 B - Apply the patch to your local version C - Avoid using HTTP/3 with curl built to use wolfSSL TIMELINE -------- This issue was reported to the curl project on May 17, 2025. We contacted distros_at_openwall on May 20, 2025. curl 8.14.0 was released on May 28 2025 around 07:00 UTC, coordinated with the publication of this advisory. The curl security team is not aware of any active exploits using this vulnerability. CREDITS ------- - Reported-by: Hiroki Kurosawa - Patched-by: Stefan Eissing Thanks a lot! -- / daniel.haxx.se || https://rock-solid.curl.dev -- Unsubscribe: https://lists.haxx.se/mailman/listinfo/curl-users Etiquette: https://curl.se/mail/etiquette.htmlReceived on 2025-05-28