CVE-2014-0139

2014-04-1514:55:00

CWE-310

[email protected]

web.nvd.nist.gov

cve-2014-0139

curl

libcurl

openssl

axtls

qsossl

gskit

tls

x.509 certificate

man-in-the-middle

ssl servers

nvd

5 Medium

AI Score

Confidence

High

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

0.002 Low

EPSS

Percentile

56.3%

JSON

cURL and libcurl 7.1 before 7.36.0, when using the OpenSSL, axtls, qsossl or gskit libraries for TLS, recognize a wildcard IP address in the subject’s Common Name (CN) field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.

CPENameOperatorVersion
haxx:curlhaxx curleq7.21.3
haxx:curlhaxx curleq7.15.1
haxx:curlhaxx curleq7.24.0
haxx:libcurlhaxx libcurleq7.19.0
haxx:libcurlhaxx libcurleq7.19.6
haxx:curlhaxx curleq7.16.1
haxx:curlhaxx curleq7.13.0
haxx:curlhaxx curleq7.35.0
haxx:curlhaxx curleq7.18.0
haxx:libcurlhaxx libcurleq7.21.2

CPE	Name	Operator	Version
haxx:curl	haxx curl	eq	7.21.3
haxx:curl	haxx curl	eq	7.15.1
haxx:curl	haxx curl	eq	7.24.0
haxx:libcurl	haxx libcurl	eq	7.19.0
haxx:libcurl	haxx libcurl	eq	7.19.6
haxx:curl	haxx curl	eq	7.16.1
haxx:curl	haxx curl	eq	7.13.0
haxx:curl	haxx curl	eq	7.35.0
haxx:curl	haxx curl	eq	7.18.0
haxx:libcurl	haxx libcurl	eq	7.21.2