CVE-2014-0139
Description
cURL/libcurl incorrectly validates SSL certificates with wildcard IP addresses in the Common Name, allowing man-in-the-middle attacks to spoof SSL servers.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
cURL/libcurl incorrectly validates SSL certificates with wildcard IP addresses in the Common Name, allowing man-in-the-middle attacks to spoof SSL servers.
Vulnerability
The vulnerability resides in the hostmatch() function of libcurl when built with OpenSSL, axtls, qsossl, or gskit TLS libraries. It incorrectly allows wildcard characters in the Common Name (CN) field of X.509 certificates to match IP addresses, violating RFC 2818 requirements. Affected versions are curl 7.10.3 through 7.35.0 inclusive [4].
Exploitation
An attacker must obtain a certificate from a legitimate Certification Authority that includes a wildcard IP address in the CN field. The attacker then performs a man-in-the-middle attack, presenting this certificate to a victim using libcurl to connect to an IP address. The victim's libcurl incorrectly accepts the wildcard match, allowing the attacker to impersonate the intended server [4].
Impact
Successful exploitation enables the attacker to spoof arbitrary SSL servers, potentially leading to interception and modification of encrypted traffic. This compromises confidentiality and integrity of data transmitted in the TLS session, but does not grant code execution or privilege escalation [4].
Mitigation
The fix is included in curl version 7.36.0, released on April 9, 2014. Users should upgrade to curl 7.36.0 or later. For systems using affected TLS libraries, ensure libcurl is updated. No workaround is available other than upgrading [4].
AI Insight generated on May 23, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
134cpe:2.3:a:haxx:curl:7.10.6:*:*:*:*:*:*:*+ 65 more
- cpe:2.3:a:haxx:curl:7.10.6:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.10.7:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.10.8:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.11.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.11.1:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.11.2:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.12.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.12.1:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.12.2:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.12.3:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.13.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.13.1:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.13.2:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.14.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.14.1:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.15.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.15.1:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.15.2:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.15.3:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.15.4:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.15.5:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.16.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.16.1:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.16.2:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.16.3:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.16.4:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.17.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.17.1:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.18.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.18.1:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.18.2:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.19.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.19.1:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.19.2:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.19.3:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.19.4:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.19.5:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.19.6:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.19.7:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.20.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.20.1:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.21.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.21.1:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.21.2:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.21.3:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.21.4:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.21.5:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.21.6:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.21.7:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.22.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.23.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.23.1:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.24.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.25.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.26.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.27.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.28.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.28.1:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.29.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.30.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.31.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.32.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.33.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.34.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.35.0:*:*:*:*:*:*:*
- (no CPE)range: 7.1 before 7.36.0
cpe:2.3:a:haxx:libcurl:7.10.6:*:*:*:*:*:*:*+ 65 more
- cpe:2.3:a:haxx:libcurl:7.10.6:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.10.7:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.10.8:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.11.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.11.1:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.11.2:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.12.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.12.1:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.12.2:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.12.3:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.13.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.13.1:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.13.2:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.14.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.14.1:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.15.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.15.1:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.15.2:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.15.3:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.15.4:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.15.5:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.16.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.16.1:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.16.2:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.16.3:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.16.4:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.17.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.17.1:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.18.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.18.1:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.18.2:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.19.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.19.1:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.19.2:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.19.3:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.19.4:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.19.5:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.19.6:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.19.7:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.20.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.20.1:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.21.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.21.1:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.21.2:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.21.3:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.21.4:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.21.5:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.21.6:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.21.7:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.22.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.23.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.23.1:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.24.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.25.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.26.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.27.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.28.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.28.1:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.29.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.30.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.31.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.32.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.33.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.34.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.35.0:*:*:*:*:*:*:*
- (no CPE)range: 7.1 before 7.36.0
- osv-coords2 versionspkg:rpm/opensuse/curl&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/lftp&distro=openSUSE%20Tumbleweed
< 7.51.0-1.1+ 1 more
- (no CPE)range: < 7.51.0-1.1
- (no CPE)range: < 4.7.4-1.1
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
17- curl.haxx.se/docs/adv_20140326B.htmlnvdVendor Advisory
- advisories.mageia.org/MGASA-2015-0165.htmlnvd
- lists.opensuse.org/opensuse-updates/2014-04/msg00042.htmlnvd
- secunia.com/advisories/57836nvd
- secunia.com/advisories/57966nvd
- secunia.com/advisories/57968nvd
- secunia.com/advisories/58615nvd
- secunia.com/advisories/59458nvd
- www-01.ibm.com/support/docview.wssnvd
- www-947.ibm.com/support/entry/portal/docdisplaynvd
- www.debian.org/security/2014/dsa-2902nvd
- www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/nvd
- www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/nvd
- www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/nvd
- www.mandriva.com/security/advisoriesnvd
- www.oracle.com/technetwork/topics/security/cpujul2015-2367936.htmlnvd
- www.ubuntu.com/usn/USN-2167-1nvd
News mentions
0No linked articles in our index yet.