CVE-2014-1263

curl and libcurl 7.27.0 through 7.35.0, when using the SecureTransport/Darwinssl backend, as used in in Apple OS X 10.9.x before 10.9.2, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate when accessing a URL that uses a numerical IP address, which allows man-in-the-middle attackers to spoof servers via an arbitrary valid certificate.

Affected products

Darwinssl, Os X, Securetransport, Curl, Ios, Libcurl

Apple Mac Os X

≤ 10.9.1, 10.9

Fix

Available

CVSS 2.0

4.3 MEDIUM

EPSS

2.9% (86th percentile)

Weakness

CWE-310

NVD status

Modified

Published

2014-02-27