PT-2014-1828 · Curl+4 · Libcurl+5
Published
2014-03-26
·
Updated
2026-05-18
·
CVE-2014-0138
CVSS v2.0
6.8
Medium
| Vector | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
cURL and libcurl versions 7.10.6 through 7.36.0
Description
The default configuration in cURL and libcurl re-uses connections for various protocols, which might allow context-dependent attackers to connect as other users via a request. This issue can lead to a violation of confidentiality, integrity, and availability of protected information. The exploitation of this issue can be done remotely.
Recommendations
For versions 7.10.6 through 7.36.0, update to version 7.36.0 or later to resolve the issue.
As a temporary workaround, consider disabling the re-use of connections for SCP, SFTP, POP3, POP3S, IMAP, IMAPS, SMTP, SMTPS, LDAP, and LDAPS protocols until a patch is available.
Restrict access to sensitive information and resources to minimize the risk of exploitation.
Fix
Improper Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Centos
Red Hat
Suse
Curl
Libcurl