开源项目curl成为CNA（漏洞编号分配机构）后获得自主分配CVE的权力，迄今已发布57个CVE1。针对一个主机名通配符证书验证缺陷的报告，curl团队认为其风险极低不应编号，但报告者向MITRE提出异议。经过数月纠纷后，MITRE TL-Root最终裁定支持curl的立场，决定不为该问题分配CVE1。
该问题于2025年12月8日被修复1，但在2026年2月10日收到争议申请1。MITRE在经过多轮沟通后，于2026年6月24日作出最终裁定1。MITRE TL-Root明确指出："这是一个已在主分支中修复的缺陷，但由于它需要具有特权的本地攻击者才能触发，因此不被视为安全漏洞"1。该问题需要满足特定条件：用户使用带前导点的主机名（如https://.example.com/）、存在包含通配符的证书，且仅在特定TLS后端（OpenSSL或Schannel）上触发1。
curl的libcurl库拥有约300亿个安装实例1，这一裁决涉及广泛的用户基础。
The open-source curl project, which earned authority to self-assign CVE identifiers as a certified numbering authority (CNA) years ago, encountered a dispute over whether a hostname wildcard certificate validation issue warranted security classification.1 The curl team argued the bug posed minimal risk and should not receive a CVE, while the original reporter challenged this assessment through MITRE.1
After months of deliberation involving multiple exchanges, MITRE's Technical Lead Root made a final determination on June 24, 2026, siding with curl's position.1 The decision concluded that the issue "is a bug, now fixed in the master branch" but "is not considered a security vulnerability because of how it requires a local attacker with privileges present to make it so."1 The problem was resolved in the project's master branch on December 8, 2025.1
The issue required specific conditions to trigger: users would need to connect using a hostname with a leading dot (such as https://.example.com/), a certificate containing wildcard entries would need to exist, and the flaw would only manifest in certain TLS backends including OpenSSL and Schannel.1 With approximately 30 billion libcurl instances installed globally, the technical constraints underlying MITRE's ruling limited its practical exploitability.1 The curl project has released 57 CVEs since becoming a CNA.1
评论
还没有评论，欢迎留下第一条。