CVE-2007-3564

{"id": "CVE-2007-3564", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2007-07-18T17:30:00.000", "references": [{"url": "http://secunia.com/advisories/26104", "tags": ["Patch", "Vendor Advisory"], "source": "security@ubuntu.com"}, {"url": "http://secunia.com/advisories/26108", "tags": ["Patch", "Vendor Advisory"], "source": "security@ubuntu.com"}, {"url": "http://secunia.com/advisories/26128", "source": "security@ubuntu.com"}, {"url": "http://secunia.com/advisories/26231", "source": "security@ubuntu.com"}, {"url": "http://www.curl.haxx.se/docs/adv_20070710.html", "tags": ["Patch", "Vendor Advisory"], "source": "security@ubuntu.com"}, {"url": "http://www.debian.org/security/2007/dsa-1333", "source": "security@ubuntu.com"}, {"url": "http://www.securityfocus.com/bid/24938", "source": "security@ubuntu.com"}, {"url": "http://www.trustix.org/errata/2007/0023/", "source": "security@ubuntu.com"}, {"url": "http://www.ubuntu.com/usn/usn-484-1", "tags": ["Patch"], "source": "security@ubuntu.com"}, {"url": "http://www.vupen.com/english/advisories/2007/2551", "source": "security@ubuntu.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35479", "source": "security@ubuntu.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "libcurl 7.14.0 through 7.16.3, when built with GnuTLS support, does not check SSL/TLS certificate expiration or activation dates, which allows remote attackers to bypass certain access restrictions."}, {"lang": "es", "value": "El libcurl 7.14.0 hasta el 7.16.3, cuando est\u00e1 construido sobre el soporte GnuTLS, no verifica la espiraci\u00f3n del certificado SSL/TLS o las fechas de activaci\u00f3n, lo que permite a atacantes remotos evitar ciertas restricciones de acceso."}], "lastModified": "2017-07-29T01:32:22.627", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:libcurl:libcurl:7.14:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ACF6D258-2A8C-40C3-9171-4C4A5B22B30C"}, {"criteria": "cpe:2.3:a:libcurl:libcurl:7.14.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9DB80911-5BD5-401D-8C0A-8229A71D0804"}, {"criteria": "cpe:2.3:a:libcurl:libcurl:7.15:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BE508863-DB77-41D3-A438-3F26C34703E3"}, {"criteria": "cpe:2.3:a:libcurl:libcurl:7.15.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4B79E431-AD91-4269-B427-DD1169D12659"}, {"criteria": "cpe:2.3:a:libcurl:libcurl:7.15.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "479069C9-D3E5-4909-8368-0B0F4704810B"}, {"criteria": "cpe:2.3:a:libcurl:libcurl:7.15.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DADB9299-3EFA-45E6-95BD-7FE2E1B1D565"}, {"criteria": "cpe:2.3:a:libcurl:libcurl:7.16.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "21F93365-54FD-45D4-B878-13A53A6806A4"}], "operator": "OR"}]}], "vendorComments": [{"comment": "Not vulnerable. The curl packages as shipped with Red Hat Enterprise Linux versions 2.1, 3, 4 and 5 are not linked against the gnutls library.", "lastModified": "2007-07-20T00:00:00", "organization": "Red Hat"}], "sourceIdentifier": "security@ubuntu.com"}