Description
lib/ssluse.c in cURL and libcurl 7.4 through 7.19.5, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | curl | 7.19.5-1.1 | — |
| Debian 13 | curl | 7.19.5-1.1 | — |
| Debian 12 | curl | 7.19.5-1.1 | — |
| Debian 5.0 | curl | 7.18.2-8lenny3 | DSA-1869-1 |
| Debian 4.0 | curl | 7.15.5-1etch3 | DSA-1869-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | curl +1 | 7.15.5-2.1.el5_3.5 | RHSA-2009:1209 |
| RHEL 4 | curl +1 | 7.12.1-11.1.el4_8.1 | RHSA-2009:1209 |
| RHEL 3 | curl +1 | 7.10.6-10.rhel3 | RHSA-2009:1209 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | curl | 7.51.0-1.1 | openSUSE-SU-2024:10303-1 |
Advisories 3
- RHSA-2009:1209 Red Hat Security Advisory: curl security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1869-1 curl - SSL certificate verification weakness Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10303-1 curl-7.51.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- http://curl.haxx.se/CVE-2009-2417/curl-7.15.1-CVE-2009-2417.patch
- http://curl.haxx.se/CVE-2009-2417/curl-7.19.0-CVE-2009-2417.patch
- http://curl.haxx.se/CVE-2009-2417/curl-7.19.5-CVE-2009-2417.patch
- http://curl.haxx.se/CVE-2009-2417/curl-7.12.1-CVE-2009-2417.patch
- 20090824 rPSA-2009-0124-1 curl mailing-list
- 37471 third-party-advisory
- ADV-2009-2263 vdb-entry
- USN-1158-1 vendor-advisory
- http://www.vmware.com/security/advisories/VMSA-2009-0016.html
- 36238 third-party-advisory
- APPLE-SA-2010-03-29-1 vendor-advisory
- curl-certificate-security-bypass(52405) vdb-entry
- http://curl.haxx.se/CVE-2009-2417/curl-7.16.4-CVE-2009-2417.patch
- http://wiki.rpath.com/Advisories:rPSA-2009-0124
- http://curl.haxx.se/CVE-2009-2417/curl-7.10.6-CVE-2009-2417.patch
- oval:org.mitre.oval:def:8542 vdb-entry signature
- http://curl.haxx.se/CVE-2009-2417/curl-7.18.1-CVE-2009-2417.patch
- 20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components mailing-list
- http://support.apple.com/kb/HT4077
- http://shibboleth.internet2.edu/secadv/secadv_20090817.txt
- 36475 third-party-advisory
- oval:org.mitre.oval:def:10114 vdb-entry signature
- http://curl.haxx.se/docs/adv_20090812.txt
- 45047 third-party-advisory
- 36032 vdb-entry
- http://curl.haxx.se/CVE-2009-2417/curl-7.15.5-CVE-2009-2417.patch
- ADV-2009-3316 vdb-entry
- http://curl.haxx.se/CVE-2009-2417/curl-7.11.0-CVE-2009-2417.patch