CVE-2016-3739

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2016-3739
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-3739.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2016-3739
Aliases
Downstream
Published
2016-05-20T14:59:05.450Z
Modified
2026-07-08T12:54:04.285017Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N CVSS Calculator
Summary
[none]
Details

The (1) mbedconnectstep1 function in lib/vtls/mbedtls.c and (2) polarsslconnectstep1 function in lib/vtls/polarssl.c in cURL and libcurl before 7.49.0, when using SSLv3 or making a TLS connection to a URL that uses a numerical IP address, allow remote attackers to spoof servers via an arbitrary valid certificate.

References

Affected packages

Git / github.com/curl/curl

Affected ranges

Type
GIT
Repo
https://github.com/curl/curl
Events
Introduced
e91d167ff8cb89523447680e3560f60d93615055
Last affected
9819cec61b00cc872136ea5faf469627b3b87e69
Database specific 
{
    "cpe": [
        "cpe:2.3:a:haxx:curl:7.21.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:haxx:curl:7.21.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:haxx:curl:7.21.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:haxx:curl:7.21.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:haxx:curl:7.21.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:haxx:curl:7.21.5:*:*:*:*:*:*:*",
        "cpe:2.3:a:haxx:curl:7.21.6:*:*:*:*:*:*:*",
        "cpe:2.3:a:haxx:curl:7.21.7:*:*:*:*:*:*:*",
        "cpe:2.3:a:haxx:curl:7.22.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:haxx:curl:7.23.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:haxx:curl:7.23.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:haxx:curl:7.24.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:haxx:curl:7.25.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:haxx:curl:7.26.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:haxx:curl:7.27.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:haxx:curl:7.28.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:haxx:curl:7.28.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:haxx:curl:7.29.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:haxx:curl:7.30.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:haxx:curl:7.31.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:haxx:curl:7.32.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:haxx:curl:7.33.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:haxx:curl:7.34.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:haxx:curl:7.35.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:haxx:curl:7.36.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:haxx:curl:7.38.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:haxx:curl:7.39.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:haxx:curl:7.40.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:haxx:curl:7.41.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:haxx:curl:7.42.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:haxx:curl:7.42.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:haxx:curl:7.43.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:haxx:curl:7.44.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:haxx:curl:7.45.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:haxx:curl:7.46.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:haxx:curl:7.47.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:haxx:curl:7.48.0:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "7.21.0"
        },
        {
            "last_affected": "7.21.0"
        },
        {
            "introduced": "7.21.1"
        },
        {
            "last_affected": "7.21.1"
        },
        {
            "introduced": "7.21.2"
        },
        {
            "last_affected": "7.21.2"
        },
        {
            "introduced": "7.21.3"
        },
        {
            "last_affected": "7.21.3"
        },
        {
            "introduced": "7.21.4"
        },
        {
            "last_affected": "7.21.4"
        },
        {
            "introduced": "7.21.5"
        },
        {
            "last_affected": "7.21.5"
        },
        {
            "introduced": "7.21.6"
        },
        {
            "last_affected": "7.21.6"
        },
        {
            "introduced": "7.21.7"
        },
        {
            "last_affected": "7.21.7"
        },
        {
            "introduced": "7.22.0"
        },
        {
            "last_affected": "7.22.0"
        },
        {
            "introduced": "7.23.0"
        },
        {
            "last_affected": "7.23.0"
        },
        {
            "introduced": "7.23.1"
        },
        {
            "last_affected": "7.23.1"
        },
        {
            "introduced": "7.24.0"
        },
        {
            "last_affected": "7.24.0"
        },
        {
            "introduced": "7.25.0"
        },
        {
            "last_affected": "7.25.0"
        },
        {
            "introduced": "7.26.0"
        },
        {
            "last_affected": "7.26.0"
        },
        {
            "introduced": "7.27.0"
        },
        {
            "last_affected": "7.27.0"
        },
        {
            "introduced": "7.28.0"
        },
        {
            "last_affected": "7.28.0"
        },
        {
            "introduced": "7.28.1"
        },
        {
            "last_affected": "7.28.1"
        },
        {
            "introduced": "7.29.0"
        },
        {
            "last_affected": "7.29.0"
        },
        {
            "introduced": "7.30.0"
        },
        {
            "last_affected": "7.30.0"
        },
        {
            "introduced": "7.31.0"
        },
        {
            "last_affected": "7.31.0"
        },
        {
            "introduced": "7.32.0"
        },
        {
            "last_affected": "7.32.0"
        },
        {
            "introduced": "7.33.0"
        },
        {
            "last_affected": "7.33.0"
        },
        {
            "introduced": "7.34.0"
        },
        {
            "last_affected": "7.34.0"
        },
        {
            "introduced": "7.35.0"
        },
        {
            "last_affected": "7.35.0"
        },
        {
            "introduced": "7.36.0"
        },
        {
            "last_affected": "7.36.0"
        },
        {
            "introduced": "7.38.0"
        },
        {
            "last_affected": "7.38.0"
        },
        {
            "introduced": "7.39.0"
        },
        {
            "last_affected": "7.39.0"
        },
        {
            "introduced": "7.40.0"
        },
        {
            "last_affected": "7.40.0"
        },
        {
            "introduced": "7.41.0"
        },
        {
            "last_affected": "7.41.0"
        },
        {
            "introduced": "7.42.0"
        },
        {
            "last_affected": "7.42.0"
        },
        {
            "introduced": "7.42.1"
        },
        {
            "last_affected": "7.42.1"
        },
        {
            "introduced": "7.43.0"
        },
        {
            "last_affected": "7.43.0"
        },
        {
            "introduced": "7.44.0"
        },
        {
            "last_affected": "7.44.0"
        },
        {
            "introduced": "7.45.0"
        },
        {
            "last_affected": "7.45.0"
        },
        {
            "introduced": "7.46.0"
        },
        {
            "last_affected": "7.46.0"
        },
        {
            "introduced": "7.47.0"
        },
        {
            "last_affected": "7.47.0"
        },
        {
            "introduced": "7.48.0"
        },
        {
            "last_affected": "7.48.0"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

7.*
7.21.0
7.21.1
7.21.2
7.21.3
7.21.4
7.21.5
7.21.6
7.21.7
7.22.0
7.23.0
7.23.1
7.24.0
7.25.0
7.26.0
7.27.0
7.28.0
7.28.1
7.29.0
7.30.0
7.31.0
7.32.0
7.33.0
7.34.0
7.35.0
7.36.0
7.38.0
7.39.0
7.40.0
7.41.0
7.42.0
7.42.1
7.43.0
7.44.0
7.45.0
7.46.0
7.47.0
7.48.0
Other
curl-7_21_0
curl-7_21_1
curl-7_21_2
curl-7_21_3
curl-7_21_4
curl-7_21_5
curl-7_21_6
curl-7_21_7
curl-7_22_0
curl-7_23_0
curl-7_23_1
curl-7_25_0
curl-7_26_0
curl-7_27_0
curl-7_28_0
curl-7_28_1
curl-7_29_0
curl-7_30_0
curl-7_31_0
curl-7_32_0
curl-7_33_0
curl-7_34_0
curl-7_35_0
curl-7_36_0
curl-7_37_0
curl-7_37_1
curl-7_38_0
curl-7_39_0
curl-7_40_0
curl-7_41_0
curl-7_42_0
curl-7_43_0
curl-7_44_0
curl-7_45_0
curl-7_46_0
curl-7_47_0
curl-7_47_1
curl-7_48_0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-3739.json"