CVE-2014-8151
published 2015-01-15CVE-2014-8151: The darwinssl_connect_step1 function in lib/vtls/curl_darwinssl.c in libcurl 7.31.0 through 7.39.0, when using the DarwinSSL (aka SecureTransport) back-end for…
PriorityP424medium5.8CVSS 2.0
AVNACMAuNCPIPAN
EPSS
1.15%
63.7th percentile
The darwinssl_connect_step1 function in lib/vtls/curl_darwinssl.c in libcurl 7.31.0 through 7.39.0, when using the DarwinSSL (aka SecureTransport) back-end for TLS, does not check if a cached TLS session validated the certificate when reusing the session, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | mac_os_x | <= 10.10.4 | — |
| apple | os_x_yosemite_v10.10.5_and_security_update_2015-006 | — | — |
| debian | curl | — | — |
| haxx | libcurl | — | — |
| haxx | libcurl | — | — |
| haxx | libcurl | — | — |
| haxx | libcurl | — | — |
| haxx | libcurl | — | — |
| haxx | libcurl | — | — |
| haxx | libcurl | — | — |
| haxx | libcurl | — | — |
| haxx | libcurl | — | — |
| haxx | libcurl | — | — |
CVSS provenance
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
vendor_debian5.8LOW
vendor_redhat5.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
curl: certificate check bypass when built with DarwinSSL as TLS backend
vendor_redhat·2015-01-08·CVSS 5.8
CVE-2014-8151 [MEDIUM] CWE-697 curl: certificate check bypass when built with DarwinSSL as TLS backend
curl: certificate check bypass when built with DarwinSSL as TLS backend
The darwinssl_connect_step1 function in lib/vtls/curl_darwinssl.c in libcurl 7.31.0 through 7.39.0, when using the DarwinSSL (aka SecureTransport) back-end for TLS, does not check if a cached TLS session validated the certificate when reusing the session, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
Statement: Not vulnerable. This issue did not affect the versions of curl as shipped with Red Hat Enterprise Linux 5, 6 and 7 as they do no use DarwinSSL library as TLS backend.
Package: curl (Red Hat Enterprise Linux 5) - Not affected
Package: curl (Red Hat Enterprise Linux 6) - Not affected
Package: curl (Red Hat Enterprise Linux 7) - Not affected
Debian
CVE-2014-8151: curl - The darwinssl_connect_step1 function in lib/vtls/curl_darwinssl.c in libcurl 7.3...
vendor_debian·2014·CVSS 5.8
CVE-2014-8151 [MEDIUM] CVE-2014-8151: curl - The darwinssl_connect_step1 function in lib/vtls/curl_darwinssl.c in libcurl 7.3...
The darwinssl_connect_step1 function in lib/vtls/curl_darwinssl.c in libcurl 7.31.0 through 7.39.0, when using the DarwinSSL (aka SecureTransport) back-end for TLS, does not check if a cached TLS session validated the certificate when reusing the session, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
Apple
CVE-2014-8151: OS X Yosemite v10.10.5 and Security Update 2015-006
vendor_apple·CVSS 5.8
CVE-2014-8151 [MEDIUM] CVE-2014-8151: OS X Yosemite v10.10.5 and Security Update 2015-006
Apple Security Update: About the security content of OS X Yosemite v10.10.5 and Security Update 2015-006
Product: OS X Yosemite v10.10.5 and Security Update 2015-006
CVE: CVE-2014-8151
Component: CVE-2014-8151
GHSA
GHSA-h2qh-xwfj-36gc: The darwinssl_connect_step1 function in lib/vtls/curl_darwinssl
ghsa_unreviewed·2022-05-17
CVE-2014-8151 [MEDIUM] GHSA-h2qh-xwfj-36gc: The darwinssl_connect_step1 function in lib/vtls/curl_darwinssl
The darwinssl_connect_step1 function in lib/vtls/curl_darwinssl.c in libcurl 7.31.0 through 7.39.0, when using the DarwinSSL (aka SecureTransport) back-end for TLS, does not check if a cached TLS session validated the certificate when reusing the session, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2014-8151 curl: certificate check bypass when built with DarwinSSL as TLS backend
bugzilla·2015-01-05·CVSS 5.8
CVE-2014-8151 [MEDIUM] CVE-2014-8151 curl: certificate check bypass when built with DarwinSSL as TLS backend
CVE-2014-8151 curl: certificate check bypass when built with DarwinSSL as TLS backend
libcurl upstream reports:
"""
libcurl stores TLS Session IDs in its associated Session ID cache when it connects to TLS servers. In subsequent connects it re-uses the entry in the cache to resume the TLS connection faster than when doing a full TLS handshake. The actual implementation for the Session ID caching varies depending on the underlying TLS backend.
libcurl allows applications to switch off certificate verification in two different ways - using CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER.
When an application connected to a TLS server with certificate verification disabled, it would store the Session ID in the cache and if then a subsequent connection was made against the same host and
Bugzilla
CVE-2014-3005 zabbix: local file inclusion via XXE attack
bugzilla·2014-06-17·CVSS 9.8
CVE-2014-3005 [CRITICAL] CVE-2014-3005 zabbix: local file inclusion via XXE attack
CVE-2014-3005 zabbix: local file inclusion via XXE attack
It was reported [1],[2] that the Zabbix frontend supported an XML data import feature, where on the server it used DOMDocument to parse the XML. By default, DOMDocument also parses the external DTD, which could allow a remote attacker to use a crafted XML file causing Zabbix to read an arbitrary local file, and send the contents of the specified file to a remote server.
This is fixed upstream via:
* svn://svn.zabbix.com/branches/dev/ZBX-8151-18 r46594 for 1.8
* svn://svn.zabbix.com/branches/dev/ZBX-8151-20 r46600 for 2.0+
[1] https://support.zabbix.com/browse/ZBX-8151
[2] http://www.pnigos.com/?p=273
Discussion:
Created zabbix22 tracking bugs for this issue:
Affects: epel-6 [bug 1110500]
---
Created zabbix tracking bugs for
http://curl.haxx.se/docs/adv_20150108A.htmlhttp://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.htmlhttp://secunia.com/advisories/61925https://security.gentoo.org/glsa/201701-47https://support.apple.com/kb/HT205031http://curl.haxx.se/docs/adv_20150108A.htmlhttp://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.htmlhttp://secunia.com/advisories/61925https://security.gentoo.org/glsa/201701-47https://support.apple.com/kb/HT205031
2015-01-15
Published