Critical Vulnerability in cURL: Wildcard IP Address Spoofing Risk
Summary
ALPINE-CVE-2014-0139: cURL and libcurl 7.1 before 7.36.0, when using the OpenSSL, axtls, qsossl or gskit libraries for TLS, recognize a wildcard IP address in the subject's Common Name (CN) field of an X.509 certificate, which might allow man... Affects curl versions < 7.36.0-r0. Fixed in 7.36.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
cURL is a widely used command-line tool and library for transferring data with URLs. It supports various protocols including HTTP, HTTPS, FTP, and more, making it essential for web communication. cURL is often integrated into applications for handling data transfers securely. However, certain versions of cURL are vulnerable to a security flaw that allows attackers to exploit wildcard IP addresses in SSL certificates, potentially leading to man-in-the-middle attacks.
Vulnerability Detail
The vulnerability, identified as CVE-2014-0139, affects cURL and libcurl versions prior to 7.36.0 when using OpenSSL, axtls, qsossl, or gskit libraries for TLS. It allows attackers to spoof arbitrary SSL servers by presenting a crafted certificate issued by a legitimate Certification Authority. This could lead to unauthorized access to sensitive data and compromise the integrity of secure communications.
How To Fix
Minimum fixed version
7.36.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using cURL versions that are vulnerable to this issue until you can update to a patched version. Additionally, consider using alternative libraries or tools that do not exhibit this vulnerability.
Conclusion
The CVE-2014-0139 vulnerability in cURL poses a significant risk by allowing attackers to spoof SSL servers. It is crucial for users to update to the patched version to safeguard their applications from potential exploits. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for curl →
FAQ
CVE-2014-0139 is a vulnerability in cURL and libcurl that allows attackers to spoof SSL servers using wildcard IP addresses in certificates.
cURL versions prior to 7.36.0 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The vulnerability can lead to man-in-the-middle attacks, where attackers can intercept and manipulate secure communications.
Yes, the patch is available in cURL version 7.36.0 and later. Updating to this version will resolve the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for curl.
