{"id":"CVE-2014-1263","aliases":["CURL-CVE-2014-1263","EUVD-2014-1341","GHSA-8p89-chvh-f3mw"],"status":"published","title":"curl and libcurl 7.27.0 through 7.35.0, when using the SecureTransport/Darwinssl backend, as used...","description":"curl and libcurl 7.27.0 through 7.35.0, when using the SecureTransport/Darwinssl backend, as used in in Apple OS X 10.9.x before 10.9.2, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate when accessing a URL that uses a numerical IP address, which allows man-in-the-middle attackers to spoof servers via an arbitrary valid certificate.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02862,"percentile":0.8685,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-310"],"published":"2014-02-27T01:00:00Z","modified":"2026-10-26T13:07:53Z","products":[{"vendor":"apple","product":"mac_os_x"}],"references":[{"url":"https://gist.github.com/rmoriz/fb2b0a6a0ce10550ab73","tags":["x_refsource_MISC","x_transferred","Exploit"]},{"url":"http://secunia.com/advisories/57836","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://support.apple.com/kb/HT6150","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://twitter.com/agl__/statuses/437029812046422016","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://curl.haxx.se/docs/adv_20140326C.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://secunia.com/advisories/57968","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://twitter.com/okoeroo/statuses/437272014043496449","tags":["x_refsource_MISC","x_transferred","Exploit"]},{"url":"http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://secunia.com/advisories/57966","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-1263"},{"url":"http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release"},{"url":"http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release"},{"url":"http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release"},{"url":"https://github.com/advisories/GHSA-8p89-chvh-f3mw"}],"sources":{"cve":[{"id":"CVE-2014-1263","description":"curl and libcurl 7.27.0 through 7.35.0, when using the SecureTransport/Darwinssl backend, as used in in Apple OS X 10.9.x before 10.9.2, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate when accessing a URL that uses a numerical IP address, which allows man-in-the-middle attackers to spoof servers via an arbitrary valid certificate.","status":"published","published":"2014-02-27T01:00:00Z","modified":"2024-08-06T09:34:41.196Z","updated_at":"2026-11-02T14:33:45.938615Z"}],"euvd":[{"id":"EUVD-2014-1341","description":"curl and libcurl 7.27.0 through 7.35.0, when using the SecureTransport/Darwinssl backend, as used in in Apple OS X 10.9.x before 10.9.2, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate when accessing a URL that uses a numerical IP address, which allows man-in-the-middle attackers to spoof servers via an arbitrary valid certificate.","status":"published","published":"2014-02-27T01:00:00Z","modified":"2024-08-06T09:34:41Z","updated_at":"2026-11-03T01:57:18.764724Z"}],"ghsa":[{"id":"GHSA-8p89-chvh-f3mw","title":"curl and libcurl 7.27.0 through 7.35.0, when using the SecureTransport/Darwinssl backend, as used...","description":"curl and libcurl 7.27.0 through 7.35.0, when using the SecureTransport/Darwinssl backend, as used in in Apple OS X 10.9.x before 10.9.2, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate when accessing a URL that uses a numerical IP address, which allows man-in-the-middle attackers to spoof servers via an arbitrary valid certificate.","status":"published","published":"2022-05-17T04:44:51Z","modified":"2025-04-12T12:30:55Z","updated_at":"2026-11-02T15:01:16.95233Z"}],"nvd":[{"id":"CVE-2014-1263","description":"curl and libcurl 7.27.0 through 7.35.0, when using the SecureTransport/Darwinssl backend, as used in in Apple OS X 10.9.x before 10.9.2, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate when accessing a URL that uses a numerical IP address, which allows man-in-the-middle attackers to spoof servers via an arbitrary valid certificate.","status":"published","published":"2014-02-27T01:55:04.07Z","modified":"2026-06-17T00:04:36.507Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-310"],"updated_at":"2026-11-02T14:02:53.330367Z"}],"osv":[{"id":"CURL-CVE-2014-1263","title":"not verifying certs for TLS to IP address / Secure Transport","description":"When asked to do a TLS connection (HTTPS, FTPS, IMAPS, etc) to a URL specified\nwith an IP address instead of a name, libcurl would wrongly not verify the\nserver's name in the certificate. The signature (whether it was signed by a\ntrusted CA) and validity (whether the date was within the certificate's\nlifetime and it was not revoked) verification was still performed.\n\nThis is a problem in libcurl built to use the Secure Transport backend. Secure\nTransport is the TLS library present and used on Mac OS X and iOS.\n\nOnly users on Mac OS X or iOS can be affected by this, and only if libcurl was\nbuilt to use the native TLS backend library.\n\nThis problem was initially used as an example of the Apple SSL bug that hit\n[the news in late February\n2014](https://www.imperialviolet.org/2014/02/22/applebug.html) but that was\nnot correct.","status":"published","published":"2014-03-26T08:00:00Z","modified":"2026-10-26T13:07:53.733842486Z","updated_at":"2026-11-02T15:43:55.669514Z"}]}}