libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
References
History
Sat, 31 May 2025 02:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-295 | |
| References |
| |
| Metrics |
threat_severity
|
threat_severity
|
Fri, 30 May 2025 17:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
Wed, 28 May 2025 08:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Wed, 28 May 2025 06:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing. | |
| Title | No QUIC certificate pinning with wolfSSL | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: curl
Published: 2025-05-28T06:29:51.915Z
Updated: 2025-05-30T16:19:53.775Z
Reserved: 2025-05-21T06:25:30.863Z
Link: CVE-2025-5025
Vulnrichment
Updated: 2025-05-28T08:03:57.908Z
NVD
Status : Awaiting Analysis
Published: 2025-05-28T07:15:24.910
Modified: 2025-05-30T17:15:30.200
Link: CVE-2025-5025
Redhat