NVD

Id
30940  
Name
CVE-2014-2522  
Description
curl and libcurl 7.27.0 through 7.35.0, when runnning on Windows and using the SChannel/Winssl TLS backend, does not verify that the server hostname matches a domain name in the subject"s Common Name (CN) or subjectAltName field of the X.509 certificate when accessing a URL that uses a numerical IP address, which allows man-in-the-middle attackers to spoof servers via an arbitrary valid certificate.  
Reject
 
CVSS Version
2  
CVSS Score
4  
Severity
Medium  
CVSS Base Score
4  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
4.9  
CVSS Vector
(AV:N/AC:H/Au:N/C:P/I:P/A:N)  
Pub Date
2017-01-19  
Published
2014-04-18  
Modified Date
2014-07-17  
Seq
2014-2522  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
162692 30940 CVE-2014-2522 http://curl.haxx.se/docs/adv_20140326D.html  View
162693 30940 CVE-2014-2522 [oss-security] 20140317 CVE request: flaw in curl"s Windows SSL backend  View
162694 30940 CVE-2014-2522 [oss-security] 20140317 Re: CVE request: flaw in curl"s Windows SSL backend  View
162695 30940 CVE-2014-2522 http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095862  View
162696 30940 CVE-2014-2522 http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/  View
162697 30940 CVE-2014-2522 http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/  View
162698 30940 CVE-2014-2522 http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/  View
162699 30940 CVE-2014-2522 66296  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
13312 JVNDB-2014-002187 cURL および libcurl におけるサーバになりすまされる脆弱性 cURL および libcurl は、Windows 上で稼動し、かつ SChannel/Winssl TLS バックエンドを使用している場合、数値 IP アドレスを使用する URL にアクセスする際に、サーバのホスト名が X.509 証明書のサブジェクトの Common Name (CN) または SubjectAltName フィールドのドメイン名と一致することを検証しないため、サーバになりすまされる脆弱性が存在します。 CVE-2014-2522 69809 CVE-2014-2522 30940 4 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-002187.html 2014-03-26 2014-08-06 View