Critical Vulnerability in cURL Package: Connection Reuse Issue
Summary
ALPINE-CVE-2014-0138: The default configuration in cURL and libcurl 7.10.6 before 7.36.0 re-uses (1) SCP, (2) SFTP, (3) POP3, (4) POP3S, (5) IMAP, (6) IMAPS, (7) SMTP, (8) SMTPS, (9) LDAP, and (10) LDAPS connections, which might allow context... Affects curl versions < 7.36.0-r0. Fixed in 7.36.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
cURL is a widely used command-line tool and library for transferring data with URLs. It supports various protocols including HTTP, HTTPS, FTP, and more. The package is essential for developers and system administrators for tasks such as file transfers and API interactions. However, certain versions of cURL are vulnerable to a connection reuse issue that can lead to unauthorized access.
Vulnerability Detail
The vulnerability, identified as CVE-2014-0138, arises from the default configuration in cURL and libcurl versions prior to 7.36.0. It allows the re-use of connections for multiple protocols including SCP, SFTP, POP3, IMAP, SMTP, LDAP, and others. This can potentially enable context-dependent attackers to connect as other users through crafted requests, posing a significant security risk.
How To Fix
Minimum fixed version
7.36.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the vulnerable protocols or configure cURL to disable connection reuse until the package is updated.
Conclusion
The cURL package has a critical vulnerability that can lead to unauthorized access through connection reuse. It is crucial for users to update to the patched version to mitigate this risk. Temporary workarounds are available, but updating is the best long-term solution.
See every vulnerability recorded for curl →
FAQ
CVE-2014-0138 is a vulnerability in cURL that allows connection reuse, potentially enabling unauthorized access.
Versions of cURL and libcurl prior to 7.36.0 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If an immediate update is not possible, consider disabling connection reuse or avoiding the use of vulnerable protocols as a temporary measure.
For more information on vulnerabilities, you can visit Vulert, which monitors and alerts for open-source vulnerabilities in real-time.
References
Related vulnerabilities
Recent vulnerabilities recorded for curl.
