Lucene search

[email protected]NVD:CVE-2014-0138

HistoryApr 15, 2014 - 2:55 p.m.

CVE-2014-0138

2014-04-1514:55:04

CWE-287

[email protected]

web.nvd.nist.gov

6.4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

6.8 Medium

AI Score

Confidence

High

0.008 Low

EPSS

Percentile

81.1%

JSON

The default configuration in cURL and libcurl 7.10.6 before 7.36.0 re-uses (1) SCP, (2) SFTP, (3) POP3, (4) POP3S, (5) IMAP, (6) IMAPS, (7) SMTP, (8) SMTPS, (9) LDAP, and (10) LDAPS connections, which might allow context-dependent attackers to connect as other users via a request, a similar issue to CVE-2014-0015.

Affected configurations

NVD

Node

haxxcurlMatch7.10.6

haxxcurlMatch7.10.7

haxxcurlMatch7.10.8

haxxcurlMatch7.11.0

haxxcurlMatch7.11.1

haxxcurlMatch7.11.2

haxxcurlMatch7.12.0

haxxcurlMatch7.12.1

haxxcurlMatch7.12.2

haxxcurlMatch7.12.3

haxxcurlMatch7.13.0

haxxcurlMatch7.13.1

haxxcurlMatch7.13.2

haxxcurlMatch7.14.0

haxxcurlMatch7.14.1

haxxcurlMatch7.15.0

haxxcurlMatch7.15.1

haxxcurlMatch7.15.2

haxxcurlMatch7.15.3

haxxcurlMatch7.15.4

haxxcurlMatch7.15.5

haxxcurlMatch7.16.0

haxxcurlMatch7.16.1

haxxcurlMatch7.16.2

haxxcurlMatch7.16.3

haxxcurlMatch7.16.4

haxxcurlMatch7.17.0

haxxcurlMatch7.17.1

haxxcurlMatch7.18.0

haxxcurlMatch7.18.1

haxxcurlMatch7.18.2

haxxcurlMatch7.19.0

haxxcurlMatch7.19.1

haxxcurlMatch7.19.2

haxxcurlMatch7.19.3

haxxcurlMatch7.19.4

haxxcurlMatch7.19.5

haxxcurlMatch7.19.6

haxxcurlMatch7.19.7

haxxcurlMatch7.20.0

haxxcurlMatch7.20.1

haxxcurlMatch7.21.0

haxxcurlMatch7.21.1

haxxcurlMatch7.21.2

haxxcurlMatch7.21.3

haxxcurlMatch7.21.4

haxxcurlMatch7.21.5

haxxcurlMatch7.21.6

haxxcurlMatch7.21.7

haxxcurlMatch7.22.0

haxxcurlMatch7.23.0

haxxcurlMatch7.23.1

haxxcurlMatch7.24.0

haxxcurlMatch7.25.0

haxxcurlMatch7.26.0

haxxcurlMatch7.27.0

haxxcurlMatch7.28.0

haxxcurlMatch7.28.1

haxxcurlMatch7.29.0

haxxcurlMatch7.30.0

haxxcurlMatch7.31.0

haxxcurlMatch7.32.0

haxxcurlMatch7.33.0

haxxcurlMatch7.34.0

haxxcurlMatch7.35.0

haxxlibcurlMatch7.10.6

haxxlibcurlMatch7.10.7

haxxlibcurlMatch7.10.8

haxxlibcurlMatch7.11.0

haxxlibcurlMatch7.11.1

haxxlibcurlMatch7.11.2

haxxlibcurlMatch7.12.0

haxxlibcurlMatch7.12.1

haxxlibcurlMatch7.12.2

haxxlibcurlMatch7.12.3

haxxlibcurlMatch7.13.0

haxxlibcurlMatch7.13.1

haxxlibcurlMatch7.13.2

haxxlibcurlMatch7.14.0

haxxlibcurlMatch7.14.1

haxxlibcurlMatch7.15.0

haxxlibcurlMatch7.15.1

haxxlibcurlMatch7.15.2

haxxlibcurlMatch7.15.3

haxxlibcurlMatch7.15.4

haxxlibcurlMatch7.15.5

haxxlibcurlMatch7.16.0

haxxlibcurlMatch7.16.1

haxxlibcurlMatch7.16.2

haxxlibcurlMatch7.16.3

haxxlibcurlMatch7.16.4

haxxlibcurlMatch7.17.0

haxxlibcurlMatch7.17.1

haxxlibcurlMatch7.18.0

haxxlibcurlMatch7.18.1

haxxlibcurlMatch7.18.2

haxxlibcurlMatch7.19.0

haxxlibcurlMatch7.19.1

haxxlibcurlMatch7.19.2

haxxlibcurlMatch7.19.3

haxxlibcurlMatch7.19.4

haxxlibcurlMatch7.19.5

haxxlibcurlMatch7.19.6

haxxlibcurlMatch7.19.7

haxxlibcurlMatch7.20.0

haxxlibcurlMatch7.20.1

haxxlibcurlMatch7.21.0

haxxlibcurlMatch7.21.1

haxxlibcurlMatch7.21.2

haxxlibcurlMatch7.21.3

haxxlibcurlMatch7.21.4

haxxlibcurlMatch7.21.5

haxxlibcurlMatch7.21.6

haxxlibcurlMatch7.21.7

haxxlibcurlMatch7.22.0

haxxlibcurlMatch7.23.0

haxxlibcurlMatch7.23.1

haxxlibcurlMatch7.24.0

haxxlibcurlMatch7.25.0

haxxlibcurlMatch7.26.0

haxxlibcurlMatch7.27.0

haxxlibcurlMatch7.28.0

haxxlibcurlMatch7.28.1

haxxlibcurlMatch7.29.0

haxxlibcurlMatch7.30.0

haxxlibcurlMatch7.31.0

haxxlibcurlMatch7.32.0

haxxlibcurlMatch7.33.0

haxxlibcurlMatch7.34.0

haxxlibcurlMatch7.35.0

Node

debiandebian_linuxMatch7.0

References

curl.haxx.se/docs/adv_20140326A.html

lists.opensuse.org/opensuse-updates/2014-04/msg00042.html

seclists.org/fulldisclosure/2014/Dec/23

secunia.com/advisories/57836

secunia.com/advisories/57966

secunia.com/advisories/57968

secunia.com/advisories/58615

secunia.com/advisories/59458

www-01.ibm.com/support/docview.wss?uid=swg21675820

www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095862

www.debian.org/security/2014/dsa-2902

www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/

www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/

www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/

www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html

www.securityfocus.com/archive/1/534161/100/0/threaded

www.ubuntu.com/usn/USN-2167-1

www.vmware.com/security/advisories/VMSA-2014-0012.html

6.4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

6.8 Medium

AI Score

Confidence

High

0.008 Low

EPSS

Percentile

81.1%

JSON

Related for NVD:CVE-2014-0138