{"api_version":"1","generated_at":"2026-07-23T18:36:46+00:00","cve":"CVE-2016-3739","urls":{"html":"https://cve.report/CVE-2016-3739","api":"https://cve.report/api/cve/CVE-2016-3739.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2016-3739","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2016-3739"},"summary":{"title":"CVE-2016-3739","description":"The (1) mbed_connect_step1 function in lib/vtls/mbedtls.c and (2) polarssl_connect_step1 function in lib/vtls/polarssl.c in cURL and libcurl before 7.49.0, when using SSLv3 or making a TLS connection to a URL that uses a numerical IP address, allow remote attackers to spoof servers via an arbitrary valid certificate.","state":"PUBLISHED","assigner":"redhat","published_at":"2016-05-20 14:59:05","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-20","n/a"],"metrics":[{"version":"3.0","source":"nvd@nist.gov","type":"Primary","score":"5.3","severity":"MEDIUM","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","data":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"}},{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"2.6","severity":"","vector":"AV:N/AC:H/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:H/Au:N/C:N/I:P/A:N","baseScore":2.6,"accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"https://curl.haxx.se/changes.html#7_49_0","name":"https://curl.haxx.se/changes.html#7_49_0","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"curl - Changes","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","name":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"CPU Oct 2018","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.495349","name":"http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.495349","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"The Slackware Linux Project: Slackware Security Advisories","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.openwall.com/lists/oss-security/2024/03/27/4","name":"http://www.openwall.com/lists/oss-security/2024/03/27/4","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"http://www.securitytracker.com/id/1035907","name":"http://www.securitytracker.com/id/1035907","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"cURL mbedTLS/PolarSSL Function Usage Error Lets Remote Users Bypass Certificate Validation - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://curl.haxx.se/CVE-2016-3739.patch","name":"https://curl.haxx.se/CVE-2016-3739.patch","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"","mime":"text/x-diff","httpstatus":"200","archivestatus":"200"},{"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722","name":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Document Display | HPE Support Center","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/90726","name":"http://www.securityfocus.com/bid/90726","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"cURL/libcURL CVE-2016-3739 TLS Certificate Validation Security Bypass Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149","name":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Document Display | HPE Support Center","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://curl.haxx.se/docs/adv_20160518.html","name":"https://curl.haxx.se/docs/adv_20160518.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"curl - TLS certificate check bypass with mbedTLS/PolarSSL","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://security.gentoo.org/glsa/201701-47","name":"https://security.gentoo.org/glsa/201701-47","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"cURL: Multiple vulnerabilities (GLSA 201701-47) — Gentoo security","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-3739","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-3739","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2016","cve_id":"3739","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"haxx","cpe5":"curl","cpe6":"7.21.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"3739","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"haxx","cpe5":"curl","cpe6":"7.21.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"3739","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"haxx","cpe5":"curl","cpe6":"7.21.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"3739","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"haxx","cpe5":"curl","cpe6":"7.21.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"3739","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"haxx","cpe5":"curl","cpe6":"7.21.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"3739","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"haxx","cpe5":"curl","cpe6":"7.21.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"3739","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"haxx","cpe5":"curl","cpe6":"7.21.6","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"3739","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"haxx","cpe5":"curl","cpe6":"7.21.7","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"3739","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"haxx","cpe5":"curl","cpe6":"7.22.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"3739","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"haxx","cpe5":"curl","cpe6":"7.23.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"3739","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"haxx","cpe5":"curl","cpe6":"7.23.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"3739","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"haxx","cpe5":"curl","cpe6":"7.24.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"3739","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"haxx","cpe5":"curl","cpe6":"7.25.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"3739","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"haxx","cpe5":"curl","cpe6":"7.26.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"3739","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"haxx","cpe5":"curl","cpe6":"7.27.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"3739","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"haxx","cpe5":"curl","cpe6":"7.28.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"3739","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"haxx","cpe5":"curl","cpe6":"7.28.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"3739","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"haxx","cpe5":"curl","cpe6":"7.29.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"3739","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"haxx","cpe5":"curl","cpe6":"7.30.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"3739","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"haxx","cpe5":"curl","cpe6":"7.31.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"3739","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"haxx","cpe5":"curl","cpe6":"7.32.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"3739","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"haxx","cpe5":"curl","cpe6":"7.33.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"3739","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"haxx","cpe5":"curl","cpe6":"7.34.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"3739","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"haxx","cpe5":"curl","cpe6":"7.35.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"3739","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"haxx","cpe5":"curl","cpe6":"7.36.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"3739","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"haxx","cpe5":"curl","cpe6":"7.38.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"3739","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"haxx","cpe5":"curl","cpe6":"7.39.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"3739","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"haxx","cpe5":"curl","cpe6":"7.40.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"3739","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"haxx","cpe5":"curl","cpe6":"7.41.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"3739","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"haxx","cpe5":"curl","cpe6":"7.42.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"3739","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"haxx","cpe5":"curl","cpe6":"7.42.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"3739","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"haxx","cpe5":"curl","cpe6":"7.43.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"3739","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"haxx","cpe5":"curl","cpe6":"7.44.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"3739","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"haxx","cpe5":"curl","cpe6":"7.45.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"3739","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"haxx","cpe5":"curl","cpe6":"7.46.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"3739","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"haxx","cpe5":"curl","cpe6":"7.47.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"3739","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"haxx","cpe5":"curl","cpe6":"7.48.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2016-3739","qid":"710385","title":"Gentoo Linux cURL Multiple Vulnerabilities (GLSA 201701-47)"}]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T00:03:34.619Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_transferred"],"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149"},{"name":"1035907","tags":["vdb-entry","x_transferred"],"url":"http://www.securitytracker.com/id/1035907"},{"tags":["x_transferred"],"url":"https://curl.haxx.se/docs/adv_20160518.html"},{"name":"SSA:2016-141-01","tags":["vendor-advisory","x_transferred"],"url":"http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.495349"},{"name":"90726","tags":["vdb-entry","x_transferred"],"url":"http://www.securityfocus.com/bid/90726"},{"tags":["x_transferred"],"url":"https://curl.haxx.se/CVE-2016-3739.patch"},{"tags":["x_transferred"],"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722"},{"tags":["x_transferred"],"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html"},{"name":"GLSA-201701-47","tags":["vendor-advisory","x_transferred"],"url":"https://security.gentoo.org/glsa/201701-47"},{"tags":["x_transferred"],"url":"https://curl.haxx.se/changes.html#7_49_0"},{"name":"[oss-security] 20240327 [SECURITY ADVISORY] curl: CVE-2024-2466: TLS certificate check bypass with mbedTLS","tags":["mailing-list","x_transferred"],"url":"http://www.openwall.com/lists/oss-security/2024/03/27/4"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2016-05-18T00:00:00.000Z","descriptions":[{"lang":"en","value":"The (1) mbed_connect_step1 function in lib/vtls/mbedtls.c and (2) polarssl_connect_step1 function in lib/vtls/polarssl.c in cURL and libcurl before 7.49.0, when using SSLv3 or making a TLS connection to a URL that uses a numerical IP address, allow remote attackers to spoof servers via an arbitrary valid certificate."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2024-05-01T17:11:05.253Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat"},"references":[{"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149"},{"name":"1035907","tags":["vdb-entry"],"url":"http://www.securitytracker.com/id/1035907"},{"url":"https://curl.haxx.se/docs/adv_20160518.html"},{"name":"SSA:2016-141-01","tags":["vendor-advisory"],"url":"http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.495349"},{"name":"90726","tags":["vdb-entry"],"url":"http://www.securityfocus.com/bid/90726"},{"url":"https://curl.haxx.se/CVE-2016-3739.patch"},{"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html"},{"name":"GLSA-201701-47","tags":["vendor-advisory"],"url":"https://security.gentoo.org/glsa/201701-47"},{"url":"https://curl.haxx.se/changes.html#7_49_0"},{"name":"[oss-security] 20240327 [SECURITY ADVISORY] curl: CVE-2024-2466: TLS certificate check bypass with mbedTLS","tags":["mailing-list"],"url":"http://www.openwall.com/lists/oss-security/2024/03/27/4"}]}},"cveMetadata":{"assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","assignerShortName":"redhat","cveId":"CVE-2016-3739","datePublished":"2016-05-20T00:00:00.000Z","dateReserved":"2016-03-30T00:00:00.000Z","dateUpdated":"2024-08-06T00:03:34.619Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2016-05-20 14:59:05","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-20","n/a"],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:H/Au:N/C:N/I:P/A:N","baseScore":2.6,"accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":4.9,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:haxx:curl:7.21.0:*:*:*:*:*:*:*","matchCriteriaId":"E5CA3936-4602-40E6-B75C-58D3F24268E9"},{"vulnerable":true,"criteria":"cpe:2.3:a:haxx:curl:7.21.1:*:*:*:*:*:*:*","matchCriteriaId":"D87C110C-21DD-438A-90EF-BE516CF59F3C"},{"vulnerable":true,"criteria":"cpe:2.3:a:haxx:curl:7.21.2:*:*:*:*:*:*:*","matchCriteriaId":"AD2D9E0E-2EED-4FB5-859C-05226FC48D7E"},{"vulnerable":true,"criteria":"cpe:2.3:a:haxx:curl:7.21.3:*:*:*:*:*:*:*","matchCriteriaId":"7CA01E21-71CE-4B07-B5A6-D0D7AC493A5D"},{"vulnerable":true,"criteria":"cpe:2.3:a:haxx:curl:7.21.4:*:*:*:*:*:*:*","matchCriteriaId":"51239254-31CE-4BF7-8669-1525BA391362"},{"vulnerable":true,"criteria":"cpe:2.3:a:haxx:curl:7.21.5:*:*:*:*:*:*:*","matchCriteriaId":"2E2BE20D-232D-4C86-81B0-C82CCC1CAA62"},{"vulnerable":true,"criteria":"cpe:2.3:a:haxx:curl:7.21.6:*:*:*:*:*:*:*","matchCriteriaId":"D652FD7C-1521-4391-AAE1-0A4D6F4CE8F8"},{"vulnerable":true,"criteria":"cpe:2.3:a:haxx:curl:7.21.7:*:*:*:*:*:*:*","matchCriteriaId":"DB861143-F809-45CF-95BE-E64F4BA1A0DC"},{"vulnerable":true,"criteria":"cpe:2.3:a:haxx:curl:7.22.0:*:*:*:*:*:*:*","matchCriteriaId":"E3480F4A-0AE0-4428-9EDA-5A6B994909A7"},{"vulnerable":true,"criteria":"cpe:2.3:a:haxx:curl:7.23.0:*:*:*:*:*:*:*","matchCriteriaId":"936BF59E-33A8-46BA-9FBD-8763812E2F10"},{"vulnerable":true,"criteria":"cpe:2.3:a:haxx:curl:7.23.1:*:*:*:*:*:*:*","matchCriteriaId":"33168C81-6DAE-40D6-9693-68390CD71DA9"},{"vulnerable":true,"criteria":"cpe:2.3:a:haxx:curl:7.24.0:*:*:*:*:*:*:*","matchCriteriaId":"424F9604-AA9A-4D45-A521-0BDEDB723659"},{"vulnerable":true,"criteria":"cpe:2.3:a:haxx:curl:7.25.0:*:*:*:*:*:*:*","matchCriteriaId":"DC6EBCEB-E52C-4FF5-B15A-6960F58090EA"},{"vulnerable":true,"criteria":"cpe:2.3:a:haxx:curl:7.26.0:*:*:*:*:*:*:*","matchCriteriaId":"D204E994-4591-403C-8EF3-D3B7BF4AA1A6"},{"vulnerable":true,"criteria":"cpe:2.3:a:haxx:curl:7.27.0:*:*:*:*:*:*:*","matchCriteriaId":"EBF5418D-1162-4B1E-BC3D-06A3E084BEFB"},{"vulnerable":true,"criteria":"cpe:2.3:a:haxx:curl:7.28.0:*:*:*:*:*:*:*","matchCriteriaId":"1CA65F31-3D54-4F66-A0A3-2BD993FF38F7"},{"vulnerable":true,"criteria":"cpe:2.3:a:haxx:curl:7.28.1:*:*:*:*:*:*:*","matchCriteriaId":"41ACC9FE-62FF-424B-B4B8-B033FEAF7686"},{"vulnerable":true,"criteria":"cpe:2.3:a:haxx:curl:7.29.0:*:*:*:*:*:*:*","matchCriteriaId":"F8BC39E9-5945-4DC8-ACA8-1C9918D9F279"},{"vulnerable":true,"criteria":"cpe:2.3:a:haxx:curl:7.30.0:*:*:*:*:*:*:*","matchCriteriaId":"B9658447-FBB0-4DEA-8FEE-BD4D3D1BF7FF"},{"vulnerable":true,"criteria":"cpe:2.3:a:haxx:curl:7.31.0:*:*:*:*:*:*:*","matchCriteriaId":"5ECABFCB-0D02-4B5B-BB35-C6B3C0896348"},{"vulnerable":true,"criteria":"cpe:2.3:a:haxx:curl:7.32.0:*:*:*:*:*:*:*","matchCriteriaId":"5A5176F0-E62F-46FF-B536-DC0680696773"},{"vulnerable":true,"criteria":"cpe:2.3:a:haxx:curl:7.33.0:*:*:*:*:*:*:*","matchCriteriaId":"506A3761-3D24-43DB-88D8-4EB5B9E8BA5C"},{"vulnerable":true,"criteria":"cpe:2.3:a:haxx:curl:7.34.0:*:*:*:*:*:*:*","matchCriteriaId":"0B6EF8B0-0E86-449C-A500-ACD902A78C7F"},{"vulnerable":true,"criteria":"cpe:2.3:a:haxx:curl:7.35.0:*:*:*:*:*:*:*","matchCriteriaId":"4D558CC2-0146-4887-834E-19FCB1D512A3"},{"vulnerable":true,"criteria":"cpe:2.3:a:haxx:curl:7.36.0:*:*:*:*:*:*:*","matchCriteriaId":"6931764D-16AB-4546-9CE3-5B4E03BC984A"},{"vulnerable":true,"criteria":"cpe:2.3:a:haxx:curl:7.38.0:*:*:*:*:*:*:*","matchCriteriaId":"EFC7535F-B8C7-490F-A2F9-1DCFD41A3C9B"},{"vulnerable":true,"criteria":"cpe:2.3:a:haxx:curl:7.39.0:*:*:*:*:*:*:*","matchCriteriaId":"3CCBFE6D-F6A9-4394-9AF8-F830DC7E6A81"},{"vulnerable":true,"criteria":"cpe:2.3:a:haxx:curl:7.40.0:*:*:*:*:*:*:*","matchCriteriaId":"5DEBBFCA-6A18-4F8F-B841-50255C952FA0"},{"vulnerable":true,"criteria":"cpe:2.3:a:haxx:curl:7.41.0:*:*:*:*:*:*:*","matchCriteriaId":"FEEAE437-A645-468B-B283-44799658F534"},{"vulnerable":true,"criteria":"cpe:2.3:a:haxx:curl:7.42.0:*:*:*:*:*:*:*","matchCriteriaId":"03F7EE95-4EBE-4306-ADFE-A1A92CAD5F24"},{"vulnerable":true,"criteria":"cpe:2.3:a:haxx:curl:7.42.1:*:*:*:*:*:*:*","matchCriteriaId":"79F7AE71-7A18-4737-9C02-0A3343B3AD4C"},{"vulnerable":true,"criteria":"cpe:2.3:a:haxx:curl:7.43.0:*:*:*:*:*:*:*","matchCriteriaId":"BC589DE6-773A-43E8-9393-3083DB545671"},{"vulnerable":true,"criteria":"cpe:2.3:a:haxx:curl:7.44.0:*:*:*:*:*:*:*","matchCriteriaId":"24D735EA-04E3-47E7-A859-3CC1ED887E10"},{"vulnerable":true,"criteria":"cpe:2.3:a:haxx:curl:7.45.0:*:*:*:*:*:*:*","matchCriteriaId":"063C1A70-0869-4933-88D7-ECE7ACCF0F99"},{"vulnerable":true,"criteria":"cpe:2.3:a:haxx:curl:7.46.0:*:*:*:*:*:*:*","matchCriteriaId":"70B0A020-3DA1-4753-B810-C60E7CA06839"},{"vulnerable":true,"criteria":"cpe:2.3:a:haxx:curl:7.47.0:*:*:*:*:*:*:*","matchCriteriaId":"63A18050-0DA7-400A-B564-AC9A020D57CD"},{"vulnerable":true,"criteria":"cpe:2.3:a:haxx:curl:7.48.0:*:*:*:*:*:*:*","matchCriteriaId":"11D8B02D-5A97-4F9A-8EE8-D60D621E0B0D"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2016","CveId":"3739","Ordinal":"1","Title":"CVE-2016-3739","CVE":"CVE-2016-3739","Year":"2016"},"notes":[{"CveYear":"2016","CveId":"3739","Ordinal":"1","NoteData":"The (1) mbed_connect_step1 function in lib/vtls/mbedtls.c and (2) polarssl_connect_step1 function in lib/vtls/polarssl.c in cURL and libcurl before 7.49.0, when using SSLv3 or making a TLS connection to a URL that uses a numerical IP address, allow remote attackers to spoof servers via an arbitrary valid certificate.","Type":"Description","Title":"CVE-2016-3739"},{"CveYear":"2016","CveId":"3739","Ordinal":"2","NoteData":"2016-05-20","Type":"Other","Title":"Published"},{"CveYear":"2016","CveId":"3739","Ordinal":"3","NoteData":"2018-10-16","Type":"Other","Title":"Modified"}]}}}