CVE:CVE-2013-4545
CNNVD:CNNVD-201311-372
Haxx Haxx curl和libcurl都是瑞典Haxx公司的产品。curl是一套利用URL语法在命令行下工作的文件传输工具。libcurl是一个免费、开源的客户端URL传输库。
cURL和libcurl 7.18.0至7.32.0版本中存在安全绕过漏洞，该漏洞源于当禁用数字签名(CURLOPT_SSL_VERIFYPEER)时，cURL工具同时禁用SSL证书主机名检查。攻击者可通过实施中间人攻击利用该漏洞借助特制的证书欺骗SSL服务器。
solution:Upgrade haxx curl to a higher version than 7.18.0,7.18.1,7.18.2,7.19.0,7.19.1,7.19.2,7.19.3,7.19.4,7.19.5,7.19.6,7.19.7,7.20.0,7.20.1,7.21.0,7.21.1,7.21.2,7.21.3,7.21.4,7.21.5,7.21.6,7.21.7,7.22.0,7.23.0,7.23.1,7.24.0,7.25.0,7.26.0,7.27.0,7.28.0,7.28.1,7.29.0,7.30.0,7.31.0,7.32.0,and avoid the version 7.18.0,7.18.1,7.18.2,7.19.0,7.19.1,7.19.2,7.19.3,7.19.4,7.19.5,7.19.6,7.19.7,7.20.0,7.20.1,7.21.0,7.21.1,7.21.2,7.21.3,7.21.4,7.21.5,7.21.6,7.21.7,7.22.0,7.23.0,7.23.1,7.24.0,7.25.0,7.26.0,7.27.0,7.28.0,7.28.1,7.29.0,7.30.0,7.31.0,7.32.0; Upgrade haxx libcurl to a higher version than 7.18.0,7.18.1,7.18.2,7.19.0,7.19.1,7.19.2,7.19.3,7.19.4,7.19.5,7.19.6,7.19.7,7.20.0,7.20.1,7.21.0,7.21.1,7.21.2,7.21.3,7.21.4,7.21.5,7.21.6,7.21.7,7.22.0,7.23.0,7.23.1,7.24.0,7.25.0,7.26.0,7.27.0,7.28.0,7.28.1,7.29.0,7.30.0,7.31.0,7.32.0,and avoid the version 7.18.0,7.18.1,7.18.2,7.19.0,7.19.1,7.19.2,7.19.3,7.19.4,7.19.5,7.19.6,7.19.7,7.20.0,7.20.1,7.21.0,7.21.1,7.21.2,7.21.3,7.21.4,7.21.5,7.21.6,7.21.7,7.22.0,7.23.0,7.23.1,7.24.0,7.25.0,7.26.0,7.27.0,7.28.0,7.28.1,7.29.0,7.30.0,7.31.0,7.32.0