{"id":"CVE-2014-0139","aliases":["ALPINE-CVE-2014-0139","BELL-CVE-2014-0139","CURL-CVE-2014-0139","DEBIAN-CVE-2014-0139","DSA-2902-1","EUVD-2014-0198","GHSA-vwm2-85hg-5h4q","MGASA-2014-0153","MGASA-2015-0165","SUSE-SU-2015:0962-1","openSUSE-SU-2024:10303-1","openSUSE-SU-2024:10380-1"],"status":"published","title":"cURL and libcurl 7.1 before 7.36.0, when using the OpenSSL, axtls, qsossl or gskit libraries for...","description":"cURL and libcurl 7.1 before 7.36.0, when using the OpenSSL, axtls, qsossl or gskit libraries for TLS, recognize a wildcard IP address in the subject's Common Name (CN) field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.","severity":{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.04218,"percentile":0.91055,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-310"],"published":"2014-03-26T08:00:00Z","modified":"2026-10-24T23:17:46Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"curl","fixed_in":["7.36.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"curl","fixed_in":["7.36.0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"curl","fixed_in":["7.36.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"curl","fixed_in":["7.36.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"curl","fixed_in":["7.36.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"curl","fixed_in":["7.36.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"curl","fixed_in":["7.36.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"curl","fixed_in":["7.36.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"curl","fixed_in":["7.36.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"curl","fixed_in":["7.36.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"curl","fixed_in":["7.36.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"curl","fixed_in":["7.36.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"curl","fixed_in":["7.36.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"curl","fixed_in":["7.36.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"curl","fixed_in":["7.36.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.4","package":"curl","fixed_in":["7.36.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"curl","fixed_in":["7.36.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"curl","fixed_in":["7.36.0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"curl","fixed_in":["7.36.0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"curl","fixed_in":["7.36.0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"curl","fixed_in":["7.36.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"curl","fixed_in":["7.36.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"curl","fixed_in":["7.36.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["7.36.0-1"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"lftp","fixed_in":["4.4.14-1.1.mga4"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"lftp","fixed_in":["4.7.4-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.36.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.36.0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.36.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.36.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.36.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.36.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.36.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.36.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.36.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.36.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.36.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.36.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.36.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.36.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.36.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.36.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.36.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.36.0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.36.0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.36.0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.36.0-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.36.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.36.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.36.0-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.21.0-2.1+squeeze8"}]}],"versions":["7.21.0-1","7.21.0-2","7.21.0-2.1+squeeze1","7.21.0-2.1+squeeze2","7.21.0-2.1+squeeze3","7.21.0-2.1+squeeze4","7.21.0-2.1+squeeze5","7.21.0-2.1+squeeze6","7.21.0-2.1+squeeze7"],"bundled":2},{"source":"osv","ecosystem":"Debian:7","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.26.0-1+wheezy9"}]}],"versions":["7.26.0-1+wheezy2","7.26.0-1+wheezy3","7.26.0-1+wheezy4","7.26.0-1+wheezy5","7.26.0-1+wheezy6","7.26.0-1+wheezy7","7.26.0-1+wheezy8"],"bundled":2},{"source":"osv","ecosystem":"Mageia:3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.28.1-6.4.mga3"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.34.0-1.2.mga4"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:4","package":"lftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.14-1.1.mga4"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.51.0-1.1"}]}],"bundled":32},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"lftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.4-1.1"}]}]}],"products":[{"vendor":"haxx","product":"curl"},{"vendor":"haxx","product":"libcurl"}],"references":[{"url":"http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095862","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:213","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/57836","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://curl.haxx.se/docs/adv_20140326B.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"http://www.debian.org/security/2014/dsa-2902","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/","tags":["x_refsource_CONFIRM","x_transferred","article"]},{"url":"http://secunia.com/advisories/59458","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-04/msg00042.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://advisories.mageia.org/MGASA-2015-0165.html","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/58615","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/57968","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21675820","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-2167-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/","tags":["x_refsource_CONFIRM","x_transferred","article"]},{"url":"http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/","tags":["x_refsource_CONFIRM","x_transferred","article"]},{"url":"http://secunia.com/advisories/57966","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0139"},{"url":"http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release"},{"url":"http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release"},{"url":"http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release"},{"url":"https://github.com/advisories/GHSA-vwm2-85hg-5h4q"},{"url":"https://security.alpinelinux.org/vuln/CVE-2014-0139","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2014-0139","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-0139","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0153.html","tags":["advisory"]},{"url":"http://curl.haxx.se/docs/adv_20140129.html","tags":["web"]},{"url":"http://curl.haxx.se/docs/adv_20140326A.html","tags":["web"]},{"url":"http://www.debian.org/security/2014/dsa-2849","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12476","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2015-0165.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15716","tags":["report"]},{"url":"http://advisories.mageia.org/MGASA-2014-0153.html","tags":["advisory"]},{"url":"http://lftp.yar.ru/news.html","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150962-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/824517","tags":["report"]},{"url":"https://bugzilla.suse.com/849596","tags":["report"]},{"url":"https://bugzilla.suse.com/858673","tags":["report"]},{"url":"https://bugzilla.suse.com/868627","tags":["report"]},{"url":"https://bugzilla.suse.com/868629","tags":["report"]},{"url":"https://bugzilla.suse.com/870444","tags":["report"]},{"url":"https://bugzilla.suse.com/927174","tags":["report"]},{"url":"https://bugzilla.suse.com/927556","tags":["report"]},{"url":"https://bugzilla.suse.com/927746","tags":["report"]},{"url":"https://bugzilla.suse.com/928533","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0139","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3153","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-0037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-2417","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0249","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0755","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8625","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-0139","description":"cURL and libcurl 7.1 before 7.36.0, when using the OpenSSL, axtls, qsossl or gskit libraries for TLS, recognize a wildcard IP address in the subject's Common Name (CN) field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.","status":"published","published":"2014-04-15T14:00:00Z","modified":"2024-08-06T09:05:38.79Z","updated_at":"2026-11-02T14:33:47.330011Z"}],"euvd":[{"id":"EUVD-2014-0198","description":"cURL and libcurl 7.1 before 7.36.0, when using the OpenSSL, axtls, qsossl or gskit libraries for TLS, recognize a wildcard IP address in the subject's Common Name (CN) field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.","status":"published","published":"2014-04-15T14:00:00Z","modified":"2024-08-06T09:05:38Z","updated_at":"2026-11-03T01:57:22.468358Z"}],"ghsa":[{"id":"GHSA-vwm2-85hg-5h4q","title":"cURL and libcurl 7.1 before 7.36.0, when using the OpenSSL, axtls, qsossl or gskit libraries for...","description":"cURL and libcurl 7.1 before 7.36.0, when using the OpenSSL, axtls, qsossl or gskit libraries for TLS, recognize a wildcard IP address in the subject's Common Name (CN) field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.","status":"published","published":"2022-05-17T00:13:55Z","modified":"2025-04-12T12:33:30Z","updated_at":"2026-11-02T15:01:17.411211Z"}],"nvd":[{"id":"CVE-2014-0139","description":"cURL and libcurl 7.1 before 7.36.0, when using the OpenSSL, axtls, qsossl or gskit libraries for TLS, recognize a wildcard IP address in the subject's Common Name (CN) field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.","status":"published","published":"2014-04-15T14:55:04.137Z","modified":"2026-06-17T00:02:22.19Z","cvss":[{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-310"],"updated_at":"2026-11-02T14:02:53.710973Z"}],"osv":[{"id":"BELL-CVE-2014-0139","title":"CVE-2014-0139 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:48.527565Z","modified":"2026-01-28T07:20:16.109123Z","cvss":[{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:13.47097Z"},{"id":"ALPINE-CVE-2014-0139","description":"cURL and libcurl 7.1 before 7.36.0, when using the OpenSSL, axtls, qsossl or gskit libraries for TLS, recognize a wildcard IP address in the subject's Common Name (CN) field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.","status":"published","published":"2014-04-15T14:55:04.137Z","modified":"2026-10-23T15:17:40.775936266Z","updated_at":"2026-11-02T15:27:46.318571Z"},{"id":"CURL-CVE-2014-0139","title":"IP address wildcard certificate validation","description":"libcurl incorrectly validates wildcard SSL certificates containing literal\nIP addresses.\n\nRFC 2818 covers the requirements for matching Common Names (CNs) and\nsubjectAltNames in order to establish valid SSL connections. It first\ndiscusses CNs that are for hostnames, and the rules for wildcards in this\ncase. The next paragraph in the RFC then discusses CNs that are IP addresses:\n\n'In some cases, the URI is specified as an IP address rather than a\nhostname. In this case, the `iPAddress` subjectAltName must be present in the\ncertificate and must exactly match the IP in the URI.'\n\nThe intention of the RFC is clear in that you should not be able to use\nwildcards with IP addresses (in order to avoid the ability to perform\nman-in-the-middle attacks). Unfortunately libcurl fails to adhere to this\nrule under certain conditions, and subsequently it would allow and use a\nwildcard match specified in the CN field.\n\nExploiting this flaw, a malicious server could participate in a MITM attack or\neasier fool users that it is a legitimate site for whatever purpose, when it\nactually is not.\n\nA good CA should refuse to issue a certificate with the CN as indicated,\nhowever there only need be one CA to issue one in error for this issue to\nresult in the user getting no warning at all and being vulnerable to MITM.\n\nThis flaw is only present in libcurl when built to use one out of a few\nspecific TLS libraries: OpenSSL, axTLS, qsossl or gskit.\n\nThis problem is similar to one previously reported by Richard Moore, found in\nmultiple browsers.","status":"published","published":"2014-03-26T08:00:00Z","modified":"2026-10-24T23:17:46Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CVE-2014-0139","description":"cURL and libcurl 7.1 before 7.36.0, when using the OpenSSL, axtls, qsossl or gskit libraries for TLS, recognize a wildcard IP address in the subject's Common Name (CN) field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.","status":"published","published":"2014-04-15T14:55:04Z","modified":"2026-04-16T06:16:40.620408425Z","updated_at":"2026-11-02T15:43:59.361892Z"},{"id":"DEBIAN-CVE-2014-0139","description":"cURL and libcurl 7.1 before 7.36.0, when using the OpenSSL, axtls, qsossl or gskit libraries for TLS, recognize a wildcard IP address in the subject's Common Name (CN) field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.","status":"published","published":"2014-04-15T14:55:04.137Z","modified":"2026-10-23T15:47:30.693177918Z","updated_at":"2026-11-02T15:45:25.819707Z"},{"id":"DSA-2902-1","title":"curl - security update","status":"published","published":"2014-04-13T00:00:00Z","modified":"2026-03-09T01:21:43.543598Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0153","title":"Updated curl packages fix multiple vulnerabilities","description":"Updated curl packages fix security vulnerabilities:\n\nParas Sethia discovered that libcurl would sometimes mix up multiple HTTP\nand HTTPS connections with NTLM authentication to the same server, sending\nrequests for one user over the connection authenticated as a different user\n(CVE-2014-0015).\n\nlibcurl can in some circumstances re-use the wrong connection when asked to\ndo transfers using other protocols than HTTP and FTP, causing a transfer\nthat was initiated by an application to wrongfully re-use an existing\nconnection to the same server that was authenticated using different\ncredentials (CVE-2014-0138).\n\nlibcurl incorrectly validates wildcard SSL certificates containing literal\nIP addresses, so under certain conditions, it would allow and use a wildcard\nmatch specified in the CN field, allowing a malicious server to participate\nin a MITM attack or just fool users into believing that it is a legitimate\nsite (CVE-2014-0139).\n","status":"published","published":"2014-04-03T00:56:35Z","modified":"2026-04-16T06:24:33.789224057Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"MGASA-2015-0165","title":"Updated lftp packages fix CVE-2014-0139","description":"Updated lftp packages fix security vulnerability:\n\nlftp incorrectly validates wildcard SSL certificates containing literal\nIP addresses, so under certain conditions, it would allow and use a wildcard\nmatch specified in the CN field, allowing a malicious server to participate\nin a MITM attack or just fool users into believing that it is a legitimate\nsite (CVE-2014-0139).\n\nlftp was affected by this issue as it uses code from cURL for checking SSL\ncertificates.  The curl package was fixed in MGASA-2014-0153.\n","status":"published","published":"2015-04-23T21:14:25Z","modified":"2026-04-16T06:25:09.78216192Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2024:10303-1","title":"curl-7.51.0-1.1 on GA media","description":"These are all security issues fixed in the curl-7.51.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:45:23.860668Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:10380-1","title":"lftp-4.7.4-1.1 on GA media","description":"These are all security issues fixed in the lftp-4.7.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:02:11.94031Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2015:0962-1","title":"Security update for curl","description":"\nThis curl update fixes the following security issues:\n\n    * bnc#868627: wrong re-use of connections (CVE-2014-0138).\n    * bnc#868629: IP address wildcard certificate validation\n      (CVE-2014-0139).\n    * bnc#870444: --insecure option inappropriately enforcing security\n      safeguard.\n\nSecurity Issue references:\n\n    * CVE-2014-0138\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0138\u003e\n    * CVE-2014-0139\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0139\u003e\n\n","status":"published","published":"2014-04-15T15:50:15Z","modified":"2026-02-04T03:17:15.082145Z","updated_at":"2026-11-02T15:53:41.276824Z"}]}}