CVE-2014-0138: Medium severity haxx curl vulnerability

Published Apr 15, 2014

Updated

The default configuration in cURL and libcurl 7.10.6 before 7.36.0 re-uses (1) SCP, (2) SFTP, (3) POP3, (4) POP3S, (5) IMAP, (6) IMAPS, (7) SMTP, (8) SMTPS, (9) LDAP, and (10) LDAPS connections, which might allow context-dependent attackers to connect as other users via a request, a similar issue to CVE-2014-0015.

Affected Software

131 affected components

haxx curl=7.10.6

haxx curl=7.10.7

haxx curl=7.10.8

haxx curl=7.11.0

haxx curl=7.11.1

haxx curl=7.11.2

haxx curl=7.12.0

haxx curl=7.12.1

haxx curl=7.12.2

haxx curl=7.12.3

haxx curl=7.13.0

haxx curl=7.13.1

haxx curl=7.13.2

haxx curl=7.14.0

haxx curl=7.14.1

haxx curl=7.15.0

haxx curl=7.15.1

haxx curl=7.15.2

haxx curl=7.15.3

haxx curl=7.15.4

haxx curl=7.15.5

haxx curl=7.16.0

haxx curl=7.16.1

haxx curl=7.16.2

haxx curl=7.16.3

haxx curl=7.16.4

haxx curl=7.17.0

haxx curl=7.17.1

haxx curl=7.18.0

haxx curl=7.18.1

haxx curl=7.18.2

haxx curl=7.19.0

haxx curl=7.19.1

haxx curl=7.19.2

haxx curl=7.19.3

haxx curl=7.19.4

haxx curl=7.19.5

haxx curl=7.19.6

haxx curl=7.19.7

haxx curl=7.20.0

haxx curl=7.20.1

haxx curl=7.21.0

haxx curl=7.21.1

haxx curl=7.21.2

haxx curl=7.21.3

haxx curl=7.21.4

haxx curl=7.21.5

haxx curl=7.21.6

haxx curl=7.21.7

haxx curl=7.22.0

haxx curl=7.23.0

haxx curl=7.23.1

haxx curl=7.24.0

haxx curl=7.25.0

haxx curl=7.26.0

haxx curl=7.27.0

haxx curl=7.28.0

haxx curl=7.28.1

haxx curl=7.29.0

haxx curl=7.30.0

haxx curl=7.31.0

haxx curl=7.32.0

haxx curl=7.33.0

haxx curl=7.34.0

haxx curl=7.35.0

haxx libcurl=7.10.6

haxx libcurl=7.10.7

haxx libcurl=7.10.8

haxx libcurl=7.11.0

haxx libcurl=7.11.1

haxx libcurl=7.11.2

haxx libcurl=7.12.0

haxx libcurl=7.12.1

haxx libcurl=7.12.2

haxx libcurl=7.12.3

haxx libcurl=7.13.0

haxx libcurl=7.13.1

haxx libcurl=7.13.2

haxx libcurl=7.14.0

haxx libcurl=7.14.1

haxx libcurl=7.15.0

haxx libcurl=7.15.1

haxx libcurl=7.15.2

haxx libcurl=7.15.3

haxx libcurl=7.15.4

haxx libcurl=7.15.5

haxx libcurl=7.16.0

haxx libcurl=7.16.1

haxx libcurl=7.16.2

haxx libcurl=7.16.3

haxx libcurl=7.16.4

haxx libcurl=7.17.0

haxx libcurl=7.17.1

haxx libcurl=7.18.0

haxx libcurl=7.18.1

haxx libcurl=7.18.2

haxx libcurl=7.19.0

haxx libcurl=7.19.1

haxx libcurl=7.19.2

haxx libcurl=7.19.3

haxx libcurl=7.19.4

haxx libcurl=7.19.5

haxx libcurl=7.19.6

haxx libcurl=7.19.7

haxx libcurl=7.20.0

haxx libcurl=7.20.1

haxx libcurl=7.21.0

haxx libcurl=7.21.1

haxx libcurl=7.21.2

haxx libcurl=7.21.3

haxx libcurl=7.21.4

haxx libcurl=7.21.5

haxx libcurl=7.21.6

haxx libcurl=7.21.7

haxx libcurl=7.22.0

haxx libcurl=7.23.0

haxx libcurl=7.23.1

haxx libcurl=7.24.0

haxx libcurl=7.25.0

haxx libcurl=7.26.0

haxx libcurl=7.27.0

haxx libcurl=7.28.0

haxx libcurl=7.28.1

haxx libcurl=7.29.0

haxx libcurl=7.30.0

haxx libcurl=7.31.0

haxx libcurl=7.32.0

haxx libcurl=7.33.0

haxx libcurl=7.34.0

haxx libcurl=7.35.0

Debian Debian Linux=7.0

Event History

Apr 15, 2014

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Data Sourced

via NVD·02:55 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2014-0138?

CVE-2014-0138 is classified as a moderate severity vulnerability.

How do I fix CVE-2014-0138?

To address CVE-2014-0138, update cURL or libcurl to a version greater than 7.36.0.

What systems are affected by CVE-2014-0138?

CVE-2014-0138 affects versions of cURL and libcurl from 7.10.6 up to 7.36.0.

What type of attack does CVE-2014-0138 enable?

CVE-2014-0138 allows context-dependent attackers to potentially connect as other users to services that reuse connections.

Is there a patch available for CVE-2014-0138?

Yes, upgrading to cURL or libcurl version 7.36.0 or later provides a patch for CVE-2014-0138.

CVE-2014-0138: Medium severity haxx curl vulnerability

Affected Software

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2014-0138?

How do I fix CVE-2014-0138?

What systems are affected by CVE-2014-0138?

What type of attack does CVE-2014-0138 enable?

Is there a patch available for CVE-2014-0138?

Company

Resources

Contact