NetSight
IP …
medium4.0

CVE-2014-2522

curl and libcurl 7.27.0 through 7.35.0, when running on Windows and using the SChannel/Winssl TLS backend, does not verify that the server hostname matches a d…

Impact

curl and libcurl 7.27.0 through 7.35.0, when running on Windows and using the SChannel/Winssl TLS backend, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate when accessing a URL that uses a numerical IP address, which allows man-in-the-middle attackers to spoof servers via an arbitrary valid certificate.

Affected products

VendorProductAffected versions
HaxxCurl
Versions 7.27.0, 7.28.0, 7.28.1, 7.29.0, 7.30.0, 7.31.0
HaxxLibcurl
Versions 7.27.0, 7.28.0, 7.28.1, 7.29.0, 7.30.0, 7.31.0

Weakness classification

CWE-20

References