CVE-2016-3739

The (1) mbed_connect_step1 function in lib/vtls/mbedtls.c and (2) polarssl_connect_step1 function in lib/vtls/polarssl.c in cURL and libcurl before 7.49.0…

published May 20, 2016

CVSS
—
EPSS
7%
Percentile
94.0
In the wild
Unconfirmed
What it is

The (1) mbed_connect_step1 function in lib/vtls/mbedtls.c and (2) polarssl_connect_step1 function in lib/vtls/polarssl.c in cURL and libcurl before 7.49.0, when using SSLv3 or making a TLS connection to a URL that uses a numerical IP address, allow remote attackers to spoof servers via an arbitrary valid certificate.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.06925 · 94.0th percentile
Published
2016-05-20T00:00Z
EPSS history
Timeline
  • 20 MAY 00:00Z
    The (1) mbed_connect_step1 function in lib/vtls/mbedtls.c and (2) polarssl_connect_step1 function in lib/vtls/polarssl.c in cURL and libcurl before 7.49.0…
    cvelistv5