CVE:CVE-2013-6422
CNNVD:CNNVD-201312-467
Haxx libcurl是瑞典Haxx公司的一个免费、开源的客户端URL传输库。该库支持FTP、FTPS、TFTP、HTTP等。
Libcurl 7.21.4至7.33.0版本中的GnuTLS后台中存在输入验证漏洞，当禁用数字签名验证(CURLOPT_SSL_VERIFYPEER)时，程序没有正确验证CN和SAN主机名字段。远程攻击者可利用该漏洞欺骗服务器，并实施中间人(MITM)攻击。
solution:Upgrade debian debian_linux to a higher version than 7.0,and avoid the version 7.0; Upgrade canonical ubuntu_linux to a higher version than 12.04,12.10,13.04,13.10,and avoid the version 12.04,12.10,13.04,13.10; Upgrade haxx libcurl to a higher version than 7.21.4,7.21.5,7.21.6,7.21.7,7.22.0,7.23.0,7.23.1,7.24.0,7.25.0,7.26.0,7.27.0,7.28.0,7.28.1,7.29.0,7.30.0,7.31.0,7.32.0,7.33.0,and avoid the version 7.21.4,7.21.5,7.21.6,7.21.7,7.22.0,7.23.0,7.23.1,7.24.0,7.25.0,7.26.0,7.27.0,7.28.0,7.28.1,7.29.0,7.30.0,7.31.0,7.32.0,7.33.0