CVE-2014-2522: Input Validation
curl and libcurl 7.27.0 through 7.35.0, when running on Windows and using the SChannel/Winssl TLS backend, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate when accessing a URL that uses a numerical IP address, which allows man-in-the-middle attackers to spoof servers via an arbitrary valid certificate.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-2522?
CVE-2014-2522 has a medium severity rating as it affects the verification of server certificates which could allow man-in-the-middle attacks.
How do I fix CVE-2014-2522?
To fix CVE-2014-2522, update curl or libcurl to versions 7.36.0 or later where the hostname verification issue is resolved.
Which versions are affected by CVE-2014-2522?
CVE-2014-2522 affects curl and libcurl versions 7.27.0 through 7.35.0 that use the SChannel/Winssl TLS backend on Windows.
What types of attacks can CVE-2014-2522 allow?
CVE-2014-2522 can allow attackers to perform man-in-the-middle attacks by exploiting the lack of hostname verification.
Is CVE-2014-2522 present on all operating systems?
CVE-2014-2522 specifically affects curl or libcurl when running on Windows with the SChannel/Winssl TLS backend.