CVE-2025-5025

Aliases:DEBIAN-CVE-2025-5025ALPINE-CVE-2025-5025
Advisory lineage Upstream: 0 Downstream: 5
Analyzed
Published: 28 May 2025, 06:29
Last modified:30 May 2025, 16:19

Vulnerability Summary

Overall Risk (default)
medium
29/100
CVSS Score
4.8 MEDIUM
v3.1 (cve.org)
EPSS Score
0.29% LOW
0% probability +0.27%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

28 May 2025, 06:29
Published
Vulnerability first disclosed
30 May 2025, 16:19
Last Modified
Vulnerability information updated

Description

libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing.

CVSS Metrics

  • v3.1•MEDIUM•Score: 4.8CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS Trends

Current EPSS score: 0.29%• Percentile: 22%

Techniques & Countermeasures

  • CWE-295•Improper Certificate Validation

    The product does not validate, or incorrectly validates, a certificate.

Affected Systems

  • alpine•curl

    ≥ 8.5.0, < 8.14.0-r0 | ≥ 8.5.0, < 8.14.0-r0 | ≥ 8.5.0, < 8.14.0-r0 | ≥ 8.5.0, < 8.14.0-r0 | ≥ 8.5.0, < 8.14.0-r0 | ≥ 8.5.0, < 8.14.0-r0

  • curl•curl

    8.13.0 | 8.12.1 | 8.12.0 | 8.11.1 | 8.11.0 | 8.10.1 | 8.10.0 | 8.9.1 | 8.9.0 | 8.8.0 | 8.7.1 | 8.7.0 | 8.6.0 | 8.5.0

  • debian•curl

    < 8.14.0-1 | < 8.14.0-1

  • haxx•curl

    ≥ 8.5.0, < 8.14.0

References (6)