Summary

Multiple Curl vulnerabilities in Brocade Products.

CVE-2025-15079 - libssh global known_hosts override

When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts not present in the specified file if they were added as recognized in the libssh global known_hosts file

CVE-2025-15224 - libssh key passphrase bypass without agent set

When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a locally running SSH agent.

CVE-2025-14524 - bearer token leak on cross-protocol redirect

When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host.

CVE-2025-13034

When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey` with the curl tool,curl should check the public key of the server certificate to verify the peer. This check was skipped in a certain condition that would then make curl allow the connection without performing the proper check, thus not noticing a possible impostor. To skip this check, the connection had to be done with QUIC with ngtcp2 built to use GnuTLS and the user had to explicitly disable the standard certificate verification.

CVE-2025-14819 - OpenSSL partial chain store policy bypass

When doing TLS related transfers with reused easy or multi handles and altering the CURLSSLOPT_NO_PARTIALCHAIN option, libcurl could accidentally reuse a CA store cached in memory for which the partial chain option was reversed. Contrary to the user's wishes and expectations. This could make libcurl find and accept a trust chain that it otherwise would not.

CVE-2025-14017 - broken TLS options for threaded LDAPS

When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrently setup transfers. Disabling certificate verification for a specific transfer could unintentionally disable the feature for other threads as well.

CVE-2025-10148 - predictable WebSocket mask

curl's WebSocket code did not update the 32-bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection.

Products Affected

• Brocade SANnav versions before 3.0.0a

Products Not Affected

CVE-2025-10148

• Brocade Fabric OS: [VEX:Vulnerable_code_not_present]
• Brocade ASCG: [VEX: Vulnerable_code_not_in_execute_path]

CVE-2025-13034

• Brocade Fabric OS: [VEX:Vulnerable_code_not_present]
• Brocade ASCG: [VEX: Vulnerable_code_not_in_execute_path]

CVE-2025-14819

• Brocade Fabric OS 10.0.0: [VEX: Vulnerable_code_not_in_execute_path]
• Brocade Fabric OS before 10.0.0: [VEX:Vulnerable_code_not_present]
• Brocade ASCG: [VEX: Vulnerable_code_not_in_execute_path]

CVE-2025-15079, CVE-2025-15224, CVE-2025-14524, CVE-2025-14017

• Brocade Fabric OS: [VEX: Vulnerable_code_not_in_execute_path]
• Brocade ASCG: [VEX: Vulnerable_code_not_in_execute_path]

Solution

• Security update is provided in Brocade SANnav 3.0.1 and 3.0.0a

Revision History

Disclaimer

THIS DOCUMENT IS PROVIDED ON AN AS-IS BASIS SOLELY FOR INFORMATIONAL PURPOSES AND DOES NOT IMPLY ANY KIND OF GUARANTY OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. YOUR USE OF THE INFORMATION CONTAINED HEREIN IS AT YOUR OWN RISK. ALL INFORMATION PROVIDED HEREIN IS BASED ON BROCADE'S CURRENT KNOWLEDGE AND UNDERSTANDING OF THE VULNERABILITY AND IMPACT TO BROCADE HARDWARE AND SOFTWARE PRODUCTS. BROCADE RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.