CVE-2014-2522: curl and libcurl 7.27.0 through 7.35.0, when running on Windows and using the SChannel/Winssl TLS backend, does not verify that the server hostname matches a domain name in the…

Description

curl and libcurl 7.27.0 through 7.35.0, when running on Windows and using the SChannel/Winssl TLS backend, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate when accessing a URL that uses a numerical IP address, which allows man-in-the-middle attackers to spoof servers via an arbitrary valid certificate.

Exploitation

Is it being used?

Exploit prediction (EPSS)2.6% · higher than 86% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

CU

Curl · Haxx

7.27.0; 7.28.0; 7.28.1; 7.29.0; 7.30.0; 7.31.0; +4 more · source: NVD

LI

Libcurl · Haxx

7.27.0; 7.28.0; 7.28.1; 7.29.0; 7.30.0; 7.31.0; +5 more · source: NVD