CVE-2014-0138

Description

The default configuration in cURL and libcurl 7.10.6 before 7.36.0 re-uses (1) SCP, (2) SFTP, (3) POP3, (4) POP3S, (5) IMAP, (6) IMAPS, (7) SMTP, (8) SMTPS, (9) LDAP, and (10) LDAPS connections, which might allow context-dependent attackers to connect as other users via a request, a similar issue to CVE-2014-0015.

How to fix CVE-2014-0138

To remediate CVE-2014-0138, upgrade the affected package to a fixed version below.

• Alpine/curl—upgrade to 7.36.0-r0 or later
• Debian/curl—upgrade to 7.36.0-1 or later
• —upgrade to 7.21.0-2.1+squeeze8 or later

Is CVE-2014-0138 being exploited?

Moderate — EPSS is 5.1%. Track this CVE but it's not at the top of the prioritisation list.

Affected packages (3)

• from 0, < 7.36.0-r0
• from 0, < 7.36.0-1
• from 0, < 7.21.0-2.1+squeeze8

References (2)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2014-0138
• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2014-0138