icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons_061

cURL/libcURL 7.x < 7.35.0 Multiple Vulnerabilities

Medium

Synopsis

The cURL program is a library and command-line tool for transferring data using various protocols, including HTTP, FTP, and LDAP. A vulnerable version of cURL was detected from the host.

Description

Versions of cURL/libcURL older than 7.35.0 are unpatched for the following vulnerabilities:

- Security-bypass vulnerability because recent authenticated connections are allowed to be re-used, which an attacker can leverage to perform certain operations with the credentials of a recently authenticated user. (CVE-2014-0138)

- SSL certificate validation error wherein an IP address containing wildcard characters within the Common Name field is not properly validated; this can be leveraged for man-in-the-middle attacks or trusted server impersonation. (CVE-2014-0139)

Solution

Upgrade the affected packages; the next version of cURL/libcURL that fixes the issue is cURL 7.35.0.