PT-2014-1896 · Curl+6 · Libcurl+7
Richard Moore
·
Published
2014-03-26
·
Updated
2026-05-18
·
CVE-2014-0139
CVSS v2.0
6.4
Medium
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
cURL and libcurl versions prior to 7.36.0
Description
The issue allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. This is due to the incorrect validation of wildcard SSL certificates containing literal IP addresses by libcurl when using specific TLS libraries, including OpenSSL, axtls, qsossl, or gskit. According to the RFC 2818 requirements, wildcards should not be used with IP addresses to prevent man-in-the-middle attacks. However, libcurl fails to adhere to this rule under certain conditions, allowing a malicious server to participate in a MITM attack or fool users into believing it is a legitimate site.
Recommendations
For versions prior to 7.36.0, update to version 7.36.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of wildcard certificates or disabling the use of the vulnerable TLS libraries until a patch is available. Avoid using libcurl with the affected TLS libraries for sensitive operations until the issue is resolved.
Fix
Improper Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Openssl
Suse
Axtls
Curl
Gskit
Libcurl
Qsossl