Unrated severityNVD Advisory· Published Apr 18, 2014· Updated Jun 17, 2026
CVE-2014-2522
CVE-2014-2522
Description
curl and libcurl 7.27.0 through 7.35.0, when running on Windows and using the SChannel/Winssl TLS backend, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate when accessing a URL that uses a numerical IP address, which allows man-in-the-middle attackers to spoof servers via an arbitrary valid certificate.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
23cpe:2.3:a:haxx:curl:7.27.0:*:*:*:*:*:*:*+ 10 more
- cpe:2.3:a:haxx:curl:7.27.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.28.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.28.1:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.29.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.30.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.31.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.32.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.33.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.34.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:curl:7.35.0:*:*:*:*:*:*:*
- (no CPE)range: 7.27.0 to 7.35.0
cpe:2.3:a:haxx:libcurl:7.27.0:*:*:*:*:*:*:*+ 11 more
- cpe:2.3:a:haxx:libcurl:7.27.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.28.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.28.1:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.29.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.30.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.31.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.32.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.33.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.34.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.35.0:*:*:*:*:*:*:*
- cpe:2.3:a:haxx:libcurl:7.36.0:*:*:*:*:*:*:*
- (no CPE)range: 7.27.0 to 7.35.0
Patches
Vulnerability mechanics
References
12- curl.haxx.se/docs/adv_20140326D.htmlnvdPatchVendor Advisory
- secunia.com/advisories/57836nvdVendor Advisory
- secunia.com/advisories/57966nvdVendor Advisory
- secunia.com/advisories/57968nvdVendor Advisory
- seclists.org/oss-sec/2014/q1/585nvd
- seclists.org/oss-sec/2014/q1/586nvd
- secunia.com/advisories/59458nvd
- www-947.ibm.com/support/entry/portal/docdisplaynvd
- www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/nvd
- www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/nvd
- www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/nvd
- www.securityfocus.com/bid/66296nvd
News mentions
0No linked articles in our index yet.