CVE-2014-0015: Medium severity haxx libcurl vulnerability
Published Feb 2, 2014
·Updated
cURL and libcurl 7.10.6 through 7.34.0, when more than one authentication method is enabled, re-uses NTLM connections, which might allow context-dependent attackers to authenticate as other users via a request.
Affected Software
128 affected components
haxx libcurl=7.10.6
haxx libcurl=7.10.7
haxx libcurl=7.10.8
haxx libcurl=7.11.0
haxx libcurl=7.11.1
haxx libcurl=7.11.2
haxx libcurl=7.12.0
haxx libcurl=7.12.1
haxx libcurl=7.12.2
haxx libcurl=7.12.3
haxx libcurl=7.13.0
haxx libcurl=7.13.1
haxx libcurl=7.13.2
haxx libcurl=7.14.0
haxx libcurl=7.14.1
haxx libcurl=7.15.0
haxx libcurl=7.15.1
haxx libcurl=7.15.2
haxx libcurl=7.15.3
haxx libcurl=7.15.4
haxx libcurl=7.15.5
haxx libcurl=7.16.0
haxx libcurl=7.16.1
haxx libcurl=7.16.2
haxx libcurl=7.16.3
haxx libcurl=7.16.4
haxx libcurl=7.17.0
haxx libcurl=7.17.1
haxx libcurl=7.18.0
haxx libcurl=7.18.1
haxx libcurl=7.18.2
haxx libcurl=7.19.0
haxx libcurl=7.19.1
haxx libcurl=7.19.2
haxx libcurl=7.19.3
haxx libcurl=7.19.4
haxx libcurl=7.19.5
haxx libcurl=7.19.6
haxx libcurl=7.19.7
haxx libcurl=7.20.0
haxx libcurl=7.20.1
haxx libcurl=7.21.0
haxx libcurl=7.21.1
haxx libcurl=7.21.2
haxx libcurl=7.21.3
haxx libcurl=7.21.4
haxx libcurl=7.21.5
haxx libcurl=7.21.6
haxx libcurl=7.21.7
haxx libcurl=7.22.0
haxx libcurl=7.23.0
haxx libcurl=7.23.1
haxx libcurl=7.24.0
haxx libcurl=7.25.0
haxx libcurl=7.26.0
haxx libcurl=7.27.0
haxx libcurl=7.28.0
haxx libcurl=7.28.1
haxx libcurl=7.29.0
haxx libcurl=7.30.0
haxx libcurl=7.31.0
haxx libcurl=7.32.0
haxx libcurl=7.33.0
haxx libcurl=7.34.0
haxx curl=7.10.6
haxx curl=7.10.7
haxx curl=7.10.8
haxx curl=7.11.0
haxx curl=7.11.1
haxx curl=7.11.2
haxx curl=7.12.0
haxx curl=7.12.1
haxx curl=7.12.2
haxx curl=7.12.3
haxx curl=7.13.0
haxx curl=7.13.1
haxx curl=7.13.2
haxx curl=7.14.0
haxx curl=7.14.1
haxx curl=7.15.0
haxx curl=7.15.1
haxx curl=7.15.2
haxx curl=7.15.3
haxx curl=7.15.4
haxx curl=7.15.5
haxx curl=7.16.0
haxx curl=7.16.1
haxx curl=7.16.2
haxx curl=7.16.3
haxx curl=7.16.4
haxx curl=7.17.0
haxx curl=7.17.1
haxx curl=7.18.0
haxx curl=7.18.1
haxx curl=7.18.2
haxx curl=7.19.0
haxx curl=7.19.1
haxx curl=7.19.2
haxx curl=7.19.3
haxx curl=7.19.4
haxx curl=7.19.5
haxx curl=7.19.6
haxx curl=7.19.7
haxx curl=7.20.0
haxx curl=7.20.1
haxx curl=7.21.0
haxx curl=7.21.1
haxx curl=7.21.2
haxx curl=7.21.3
haxx curl=7.21.4
haxx curl=7.21.5
haxx curl=7.21.6
haxx curl=7.21.7
haxx curl=7.22.0
haxx curl=7.23.0
haxx curl=7.23.1
haxx curl=7.24.0
haxx curl=7.25.0
haxx curl=7.26.0
haxx curl=7.27.0
haxx curl=7.28.0
haxx curl=7.28.1
haxx curl=7.29.0
haxx curl=7.30.0
haxx curl=7.31.0
haxx curl=7.32.0
haxx curl=7.33.0
haxx curl=7.34.0
Event History
Feb 2, 2014
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·12:55 AM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2014-0015?
CVE-2014-0015 is rated as a medium severity vulnerability due to its potential to allow unauthorized authentication.
2
How do I fix CVE-2014-0015?
To fix CVE-2014-0015, update to libcurl or cURL version 7.34.1 or later, where the vulnerability is addressed.
3
Who is affected by CVE-2014-0015?
CVE-2014-0015 affects users of cURL and libcurl versions between 7.10.6 and 7.34.0 with multiple authentication methods enabled.
4
What type of vulnerability is CVE-2014-0015?
CVE-2014-0015 is an authentication vulnerability that allows context-dependent attackers to pose as other users.
5
When was CVE-2014-0015 discovered?
CVE-2014-0015 was disclosed in January 2014.