{"id":"CVE-2014-0138","aliases":["ALPINE-CVE-2014-0138","BELL-CVE-2014-0138","CURL-CVE-2014-0138","DEBIAN-CVE-2014-0138","DSA-2902-1","EUVD-2014-0197","GHSA-j832-g86m-353x","MGASA-2014-0153","RHSA-2014:0561","SUSE-SU-2015:0962-1","openSUSE-SU-2024:10303-1"],"status":"published","title":"The default configuration in cURL and libcurl 7.10.6 before 7.36.0 re-uses (1) SCP, (2) SFTP, (3)...","description":"The default configuration in cURL and libcurl 7.10.6 before 7.36.0 re-uses (1) SCP, (2) SFTP, (3) POP3, (4) POP3S, (5) IMAP, (6) IMAPS, (7) SMTP, (8) SMTPS, (9) LDAP, and (10) LDAPS connections, which might allow context-dependent attackers to connect as other users via a request, a similar issue to CVE-2014-0015.","severity":{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0522,"percentile":0.92564,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287"],"published":"2014-03-26T08:00:00Z","modified":"2026-10-24T23:17:46Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"curl","fixed_in":["7.36.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"curl","fixed_in":["7.36.0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"curl","fixed_in":["7.36.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"curl","fixed_in":["7.36.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"curl","fixed_in":["7.36.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"curl","fixed_in":["7.36.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"curl","fixed_in":["7.36.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"curl","fixed_in":["7.36.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"curl","fixed_in":["7.36.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"curl","fixed_in":["7.36.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"curl","fixed_in":["7.36.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"curl","fixed_in":["7.36.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"curl","fixed_in":["7.36.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"curl","fixed_in":["7.36.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"curl","fixed_in":["7.36.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.4","package":"curl","fixed_in":["7.36.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"curl","fixed_in":["7.36.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"curl","fixed_in":["7.36.0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"curl","fixed_in":["7.36.0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"curl","fixed_in":["7.36.0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"curl","fixed_in":["7.36.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"curl","fixed_in":["7.36.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"curl","fixed_in":["7.36.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["7.36.0-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.36.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.36.0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.36.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.36.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.36.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.36.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.36.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.36.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.36.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.36.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.36.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.36.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.36.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.36.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.36.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.36.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.36.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.36.0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.36.0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.36.0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.36.0-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.36.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.36.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.36.0-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.21.0-2.1+squeeze8"}]}],"versions":["7.21.0-1","7.21.0-2","7.21.0-2.1+squeeze1","7.21.0-2.1+squeeze2","7.21.0-2.1+squeeze3","7.21.0-2.1+squeeze4","7.21.0-2.1+squeeze5","7.21.0-2.1+squeeze6","7.21.0-2.1+squeeze7"],"bundled":2},{"source":"osv","ecosystem":"Debian:7","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.26.0-1+wheezy9"}]}],"versions":["7.26.0-1+wheezy2","7.26.0-1+wheezy3","7.26.0-1+wheezy4","7.26.0-1+wheezy5","7.26.0-1+wheezy6","7.26.0-1+wheezy7","7.26.0-1+wheezy8"],"bundled":2},{"source":"osv","ecosystem":"Mageia:3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.28.1-6.4.mga3"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.34.0-1.2.mga4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-37.el6_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-37.el6_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-37.el6_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-37.el6_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-37.el6_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-37.el6_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-37.el6_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-37.el6_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-37.el6_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-37.el6_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-37.el6_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-37.el6_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-37.el6_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-37.el6_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-37.el6_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-37.el6_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.51.0-1.1"}]}],"bundled":32}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"haxx","product":"curl"},{"vendor":"haxx","product":"libcurl"}],"references":[{"url":"http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095862","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://curl.haxx.se/docs/adv_20140326A.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","article"]},{"url":"http://www.vmware.com/security/advisories/VMSA-2014-0012.html","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/57836","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/archive/1/534161/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web"]},{"url":"http://www.debian.org/security/2014/dsa-2902","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/","tags":["x_refsource_CONFIRM","x_transferred","article"]},{"url":"http://secunia.com/advisories/59458","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-04/msg00042.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://secunia.com/advisories/58615","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://seclists.org/fulldisclosure/2014/Dec/23","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","web"]},{"url":"http://secunia.com/advisories/57968","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21675820","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-2167-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/","tags":["x_refsource_CONFIRM","x_transferred","article"]},{"url":"http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/","tags":["x_refsource_CONFIRM","x_transferred","article"]},{"url":"http://secunia.com/advisories/57966","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0138","tags":["advisory"]},{"url":"http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release"},{"url":"http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release"},{"url":"http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release"},{"url":"https://github.com/advisories/GHSA-j832-g86m-353x"},{"url":"https://security.alpinelinux.org/vuln/CVE-2014-0138","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2014-0138","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-0138","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0153.html","tags":["advisory"]},{"url":"http://curl.haxx.se/docs/adv_20140129.html","tags":["web"]},{"url":"http://curl.haxx.se/docs/adv_20140326B.html","tags":["web"]},{"url":"http://www.debian.org/security/2014/dsa-2849","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12476","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0561","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1053903","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1079148","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1092486","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1096797","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0561.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0015","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0015","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0015","tags":["advisory"]},{"url":"http://curl.haxx.se/docs/security.html#20140129","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0138","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0138","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150962-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/824517","tags":["report"]},{"url":"https://bugzilla.suse.com/849596","tags":["report"]},{"url":"https://bugzilla.suse.com/858673","tags":["report"]},{"url":"https://bugzilla.suse.com/868627","tags":["report"]},{"url":"https://bugzilla.suse.com/868629","tags":["report"]},{"url":"https://bugzilla.suse.com/870444","tags":["report"]},{"url":"https://bugzilla.suse.com/927174","tags":["report"]},{"url":"https://bugzilla.suse.com/927556","tags":["report"]},{"url":"https://bugzilla.suse.com/927746","tags":["report"]},{"url":"https://bugzilla.suse.com/928533","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0139","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3153","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-0037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-2417","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0249","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0755","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8625","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-0138","description":"The default configuration in cURL and libcurl 7.10.6 before 7.36.0 re-uses (1) SCP, (2) SFTP, (3) POP3, (4) POP3S, (5) IMAP, (6) IMAPS, (7) SMTP, (8) SMTPS, (9) LDAP, and (10) LDAPS connections, which might allow context-dependent attackers to connect as other users via a request, a similar issue to CVE-2014-0015.","status":"published","published":"2014-04-15T14:00:00Z","modified":"2024-08-06T09:05:38.827Z","updated_at":"2026-11-02T14:33:47.741012Z"}],"euvd":[{"id":"EUVD-2014-0197","description":"The default configuration in cURL and libcurl 7.10.6 before 7.36.0 re-uses (1) SCP, (2) SFTP, (3) POP3, (4) POP3S, (5) IMAP, (6) IMAPS, (7) SMTP, (8) SMTPS, (9) LDAP, and (10) LDAPS connections, which might allow context-dependent attackers to connect as other users via a request, a similar issue to CVE-2014-0015.","status":"published","published":"2014-04-15T14:00:00Z","modified":"2024-08-06T09:05:38Z","updated_at":"2026-11-03T01:57:22.468358Z"}],"ghsa":[{"id":"GHSA-j832-g86m-353x","title":"The default configuration in cURL and libcurl 7.10.6 before 7.36.0 re-uses (1) SCP, (2) SFTP, (3)...","description":"The default configuration in cURL and libcurl 7.10.6 before 7.36.0 re-uses (1) SCP, (2) SFTP, (3) POP3, (4) POP3S, (5) IMAP, (6) IMAPS, (7) SMTP, (8) SMTPS, (9) LDAP, and (10) LDAPS connections, which might allow context-dependent attackers to connect as other users via a request, a similar issue to CVE-2014-0015.","status":"published","published":"2022-05-14T02:54:03Z","modified":"2025-04-12T12:33:30Z","cwes":["CWE-287"],"updated_at":"2026-11-02T15:01:17.411211Z"}],"nvd":[{"id":"CVE-2014-0138","description":"The default configuration in cURL and libcurl 7.10.6 before 7.36.0 re-uses (1) SCP, (2) SFTP, (3) POP3, (4) POP3S, (5) IMAP, (6) IMAPS, (7) SMTP, (8) SMTPS, (9) LDAP, and (10) LDAPS connections, which might allow context-dependent attackers to connect as other users via a request, a similar issue to CVE-2014-0015.","status":"published","published":"2014-04-15T14:55:04.107Z","modified":"2026-06-17T00:02:22.017Z","cvss":[{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:02:53.710973Z"}],"osv":[{"id":"BELL-CVE-2014-0138","title":"CVE-2014-0138 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:13:32.182117Z","modified":"2026-01-28T07:20:14.463705Z","cvss":[{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:13.47097Z"},{"id":"ALPINE-CVE-2014-0138","description":"The default configuration in cURL and libcurl 7.10.6 before 7.36.0 re-uses (1) SCP, (2) SFTP, (3) POP3, (4) POP3S, (5) IMAP, (6) IMAPS, (7) SMTP, (8) SMTPS, (9) LDAP, and (10) LDAPS connections, which might allow context-dependent attackers to connect as other users via a request, a similar issue to CVE-2014-0015.","status":"published","published":"2014-04-15T14:55:04.107Z","modified":"2026-10-23T15:17:40.764692508Z","updated_at":"2026-11-02T15:27:46.318571Z"},{"id":"CURL-CVE-2014-0138","title":"wrong reuse of connections","description":"libcurl can in some circumstances reuse the wrong connection when asked to\ndo transfers using other protocols than HTTP and FTP.\n\nlibcurl features a pool of recent connections so that subsequent requests\ncan reuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criterion must first be met. Due to an\nerror in the code, a transfer that was initiated by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials. The existing logic only worked\nwell enough for HTTP and FTP, while all other network protocols were\nsilently, but erroneously, assumed to work like HTTP. Protocols that use\nconnection oriented authentication need a new connection when new\ncredentials are used.\n\nAffected protocols include: SCP, SFTP, POP3(S), IMAP(S), SMTP(S) and\nLDAP(S).\n\nApplications can disable libcurl's reuse of connections and thus mitigate\nthis problem, by using one of the following libcurl options to alter how\nconnections are or are not reused: `CURLOPT_FRESH_CONNECT`,\n`CURLOPT_MAXCONNECTS` and `CURLMOPT_MAX_HOST_CONNECTIONS` (if using the\ncurl_multi API).\n\n(This problem is similar to a problem previously reported to NTLM HTTP\nconnections, named [CVE-2014-0015](CVE-2014-0015.html))","status":"published","published":"2014-03-26T08:00:00Z","modified":"2026-10-24T23:17:46Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CVE-2014-0138","description":"The default configuration in cURL and libcurl 7.10.6 before 7.36.0 re-uses (1) SCP, (2) SFTP, (3) POP3, (4) POP3S, (5) IMAP, (6) IMAPS, (7) SMTP, (8) SMTPS, (9) LDAP, and (10) LDAPS connections, which might allow context-dependent attackers to connect as other users via a request, a similar issue to CVE-2014-0015.","status":"published","published":"2014-04-15T14:55:04Z","modified":"2026-04-16T06:15:48.743492346Z","updated_at":"2026-11-02T15:43:59.361892Z"},{"id":"DEBIAN-CVE-2014-0138","description":"The default configuration in cURL and libcurl 7.10.6 before 7.36.0 re-uses (1) SCP, (2) SFTP, (3) POP3, (4) POP3S, (5) IMAP, (6) IMAPS, (7) SMTP, (8) SMTPS, (9) LDAP, and (10) LDAPS connections, which might allow context-dependent attackers to connect as other users via a request, a similar issue to CVE-2014-0015.","status":"published","published":"2014-04-15T14:55:04.107Z","modified":"2026-10-23T15:47:39.497931471Z","updated_at":"2026-11-02T15:45:25.819707Z"},{"id":"DSA-2902-1","title":"curl - security update","status":"published","published":"2014-04-13T00:00:00Z","modified":"2026-03-09T01:21:43.543598Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0153","title":"Updated curl packages fix multiple vulnerabilities","description":"Updated curl packages fix security vulnerabilities:\n\nParas Sethia discovered that libcurl would sometimes mix up multiple HTTP\nand HTTPS connections with NTLM authentication to the same server, sending\nrequests for one user over the connection authenticated as a different user\n(CVE-2014-0015).\n\nlibcurl can in some circumstances re-use the wrong connection when asked to\ndo transfers using other protocols than HTTP and FTP, causing a transfer\nthat was initiated by an application to wrongfully re-use an existing\nconnection to the same server that was authenticated using different\ncredentials (CVE-2014-0138).\n\nlibcurl incorrectly validates wildcard SSL certificates containing literal\nIP addresses, so under certain conditions, it would allow and use a wildcard\nmatch specified in the CN field, allowing a malicious server to participate\nin a MITM attack or just fool users into believing that it is a legitimate\nsite (CVE-2014-0139).\n","status":"published","published":"2014-04-03T00:56:35Z","modified":"2026-04-16T06:24:33.789224057Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"openSUSE-SU-2024:10303-1","title":"curl-7.51.0-1.1 on GA media","description":"These are all security issues fixed in the curl-7.51.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:45:23.860668Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"RHSA-2014:0561","title":"Red Hat Security Advisory: curl security and bug fix update","status":"published","published":"2024-09-15T21:44:12Z","modified":"2026-06-26T10:23:59Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"SUSE-SU-2015:0962-1","title":"Security update for curl","description":"\nThis curl update fixes the following security issues:\n\n    * bnc#868627: wrong re-use of connections (CVE-2014-0138).\n    * bnc#868629: IP address wildcard certificate validation\n      (CVE-2014-0139).\n    * bnc#870444: --insecure option inappropriately enforcing security\n      safeguard.\n\nSecurity Issue references:\n\n    * CVE-2014-0138\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0138\u003e\n    * CVE-2014-0139\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0139\u003e\n\n","status":"published","published":"2014-04-15T15:50:15Z","modified":"2026-02-04T03:17:15.082145Z","updated_at":"2026-11-02T15:53:41.276824Z"}]}}