« Volver al listado

CVE-2007-3564

Estado: ModificadaAlta (7.5)—

libcurl 7.14.0 through 7.16.3, when built with GnuTLS support, does not check SSL/TLS certificate expiration or activation dates, which allows remote attackers to bypass certain access restrictions.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Libcurl — Libcurl

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2007-3564",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": true,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "security@ubuntu.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2007-07-18T17:30:00.000",
  "references": [
    {
      "url": "http://secunia.com/advisories/26104",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://secunia.com/advisories/26108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://secunia.com/advisories/26128",
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://secunia.com/advisories/26231",
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://www.curl.haxx.se/docs/adv_20070710.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://www.debian.org/security/2007/dsa-1333",
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/24938",
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://www.trustix.org/errata/2007/0023/",
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://www.ubuntu.com/usn/usn-484-1",
      "tags": [
        "Patch"
      ],
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2007/2551",
      "source": "security@ubuntu.com"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35479",
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://secunia.com/advisories/26104",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/26108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/26128",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/26231",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.curl.haxx.se/docs/adv_20070710.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2007/dsa-1333",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/24938",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.trustix.org/errata/2007/0023/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.ubuntu.com/usn/usn-484-1",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2007/2551",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35479",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "libcurl 7.14.0 through 7.16.3, when built with GnuTLS support, does not check SSL/TLS certificate expiration or activation dates, which allows remote attackers to bypass certain access restrictions."
    },
    {
      "lang": "es",
      "value": "El libcurl 7.14.0 hasta el 7.16.3, cuando está construido sobre el soporte GnuTLS, no verifica la espiración del certificado SSL/TLS o las fechas de activación, lo que permite a atacantes remotos evitar ciertas restricciones de acceso."
    }
  ],
  "lastModified": "2026-06-16T22:42:17.627",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:libcurl:libcurl:7.14:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ACF6D258-2A8C-40C3-9171-4C4A5B22B30C"
            },
            {
              "criteria": "cpe:2.3:a:libcurl:libcurl:7.14.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9DB80911-5BD5-401D-8C0A-8229A71D0804"
            },
            {
              "criteria": "cpe:2.3:a:libcurl:libcurl:7.15:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BE508863-DB77-41D3-A438-3F26C34703E3"
            },
            {
              "criteria": "cpe:2.3:a:libcurl:libcurl:7.15.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4B79E431-AD91-4269-B427-DD1169D12659"
            },
            {
              "criteria": "cpe:2.3:a:libcurl:libcurl:7.15.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "479069C9-D3E5-4909-8368-0B0F4704810B"
            },
            {
              "criteria": "cpe:2.3:a:libcurl:libcurl:7.15.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DADB9299-3EFA-45E6-95BD-7FE2E1B1D565"
            },
            {
              "criteria": "cpe:2.3:a:libcurl:libcurl:7.16.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "21F93365-54FD-45D4-B878-13A53A6806A4"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "vendorComments": [
    {
      "comment": "Not vulnerable.  The curl packages as shipped with Red Hat Enterprise Linux versions 2.1, 3, 4 and 5 are not linked against the gnutls library.",
      "lastModified": "2007-07-20T00:00:00",
      "organization": "Red Hat"
    }
  ],
  "sourceIdentifier": "security@ubuntu.com"
}