{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2015-01-08T00:00:00", "descriptions": [{"lang": "en", "value": "The darwinssl_connect_step1 function in lib/vtls/curl_darwinssl.c in libcurl 7.31.0 through 7.39.0, when using the DarwinSSL (aka SecureTransport) back-end for TLS, does not check if a cached TLS session validated the certificate when reusing the session, which allows man-in-the-middle attackers to spoof servers via a crafted certificate."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-06-30T16:57:01", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"name": "APPLE-SA-2015-08-13-2", "tags": ["vendor-advisory", "x_refsource_APPLE"], "url": "http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://curl.haxx.se/docs/adv_20150108A.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://support.apple.com/kb/HT205031"}, {"name": "GLSA-201701-47", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "https://security.gentoo.org/glsa/201701-47"}, {"name": "61925", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/61925"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secalert@redhat.com", "ID": "CVE-2014-8151", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The darwinssl_connect_step1 function in lib/vtls/curl_darwinssl.c in libcurl 7.31.0 through 7.39.0, when using the DarwinSSL (aka SecureTransport) back-end for TLS, does not check if a cached TLS session validated the certificate when reusing the session, which allows man-in-the-middle attackers to spoof servers via a crafted certificate."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "APPLE-SA-2015-08-13-2", "refsource": "APPLE", "url": "http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html"}, {"name": "http://curl.haxx.se/docs/adv_20150108A.html", "refsource": "CONFIRM", "url": "http://curl.haxx.se/docs/adv_20150108A.html"}, {"name": "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743", "refsource": "CONFIRM", "url": "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743"}, {"name": "https://support.apple.com/kb/HT205031", "refsource": "CONFIRM", "url": "https://support.apple.com/kb/HT205031"}, {"name": "GLSA-201701-47", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201701-47"}, {"name": "61925", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/61925"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T13:10:51.108Z"}, "title": "CVE Program Container", "references": [{"name": "APPLE-SA-2015-08-13-2", "tags": ["vendor-advisory", "x_refsource_APPLE", "x_transferred"], "url": "http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://curl.haxx.se/docs/adv_20150108A.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://support.apple.com/kb/HT205031"}, {"name": "GLSA-201701-47", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "https://security.gentoo.org/glsa/201701-47"}, {"name": "61925", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/61925"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2014-8151", "datePublished": "2015-01-15T15:00:00", "dateReserved": "2014-10-10T00:00:00", "dateUpdated": "2024-08-06T13:10:51.108Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*", "matchCriteriaId": "7883E465-932D-4C11-AA54-97E44181F906", "versionEndIncluding": "10.10.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:haxx:libcurl:7.31.0:*:*:*:*:*:*:*", "matchCriteriaId": "1791BF6D-2C96-4A6E-90D4-2906A73601F6", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.32.0:*:*:*:*:*:*:*", "matchCriteriaId": "260DD751-4145-4B75-B892-5FC932C6A305", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.33.0:*:*:*:*:*:*:*", "matchCriteriaId": "EFF4AD0D-2EC5-4CE8-B6B3-2EC8ED2FF118", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.34.0:*:*:*:*:*:*:*", "matchCriteriaId": "3EB1CB85-0A9B-4816-B471-278774EE6D4C", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.35.0:*:*:*:*:*:*:*", "matchCriteriaId": "3831AB03-4E7E-476D-9623-58AADC188DFE", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.36.0:*:*:*:*:*:*:*", "matchCriteriaId": "ABACE305-2F0C-4B59-BC5C-6DF162B450E4", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.37.0:*:*:*:*:*:*:*", "matchCriteriaId": "6FAC1B55-F492-484E-B837-E7745682DE0A", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.37.1:*:*:*:*:*:*:*", "matchCriteriaId": "E0D57914-B40A-462B-9C78-6433BE2B2DB4", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.38.0:*:*:*:*:*:*:*", "matchCriteriaId": "A9A12DF7-62C5-46AD-9236-E2821C64156E", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.39:*:*:*:*:*:*:*", "matchCriteriaId": "4C43697D-390A-4AC0-A5D8-62B6D22245BF", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The darwinssl_connect_step1 function in lib/vtls/curl_darwinssl.c in libcurl 7.31.0 through 7.39.0, when using the DarwinSSL (aka SecureTransport) back-end for TLS, does not check if a cached TLS session validated the certificate when reusing the session, which allows man-in-the-middle attackers to spoof servers via a crafted certificate."}, {"lang": "es", "value": "La funci\u00f3n darwinssl_connect_step1 en lib/vtls/curl_darwinssl.c en libcurl 7.31.0 hasta 7.39.0, cuando utiliza el backend DarwinSSL (tambi\u00e9n conocido como SecureTransport) para TLS, no comprueba si una sesi\u00f3n TLS en cach\u00e9 valid\u00f3 el certificado cuando se reutiliza la sesi\u00f3n, lo que permite a atacantes man-in-the-middle falsificar servidores a trav\u00e9s de un certificado manipulado."}], "evaluatorComment": "<a href=\"http://cwe.mitre.org/data/definitions/295.html\">CWE-295: Improper Certificate Validation</a>", "id": "CVE-2014-8151", "lastModified": "2024-11-21T02:18:40.093", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2015-01-15T15:59:07.670", "references": [{"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "http://curl.haxx.se/docs/adv_20150108A.html"}, {"source": "secalert@redhat.com", "url": "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743"}, {"source": "secalert@redhat.com", "url": "http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html"}, {"source": "secalert@redhat.com", "url": "http://secunia.com/advisories/61925"}, {"source": "secalert@redhat.com", "url": "https://security.gentoo.org/glsa/201701-47"}, {"source": "secalert@redhat.com", "url": "https://support.apple.com/kb/HT205031"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://curl.haxx.se/docs/adv_20150108A.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/61925"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.gentoo.org/glsa/201701-47"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://support.apple.com/kb/HT205031"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"acknowledgement": "Red Hat would like to thank curl project for reporting this issue. Upstream acknowledges Marc Hesse (RethinkDB) as the original reporter.", "bugzilla": {"description": "curl: certificate check bypass when built with DarwinSSL as TLS backend", "id": "1178698", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1178698"}, "csaw": false, "cvss": {"cvss_base_score": "2.6", "cvss_scoring_vector": "AV:N/AC:H/Au:N/C:N/I:P/A:N", "status": "draft"}, "cwe": "CWE-697->CWE-295", "details": ["The darwinssl_connect_step1 function in lib/vtls/curl_darwinssl.c in libcurl 7.31.0 through 7.39.0, when using the DarwinSSL (aka SecureTransport) back-end for TLS, does not check if a cached TLS session validated the certificate when reusing the session, which allows man-in-the-middle attackers to spoof servers via a crafted certificate."], "name": "CVE-2014-8151", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Not affected", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 5"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 7"}], "public_date": "2015-01-08T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2014-8151\nhttps://nvd.nist.gov/vuln/detail/CVE-2014-8151\nhttp://curl.haxx.se/docs/adv_20150108A.html"], "statement": "Not vulnerable. This issue did not affect the versions of curl as shipped with Red Hat Enterprise Linux 5, 6 and 7 as they do no use DarwinSSL library as TLS backend.", "threat_severity": "Low", "upstream_fix": "libcurl 7.40.0"}