CVE-2014-0138
Fixed in a distro release EPSS 5%
The default configuration in cURL and libcurl 7.10.6 before 7.36.0 re-uses (1) SCP, (2) SFTP, (3) POP3, (4) POP3S, (5) IMAP, (6) IMAPS, (7) SMTP, (8) SMTPS, (9) LDAP, and (10) LDAPS connections, which might allow context-dependent attackers to connect as other users via a request, a similar issue to CVE-2014-0015.
Products: haxx curl, haxx libcurl, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.10 | curl | 7.36.0-r0 |
| Alpine 3.11 | curl | 7.36.0 |
| Alpine 3.12 | curl | 7.36.0-r0 |
| Alpine 3.13 | curl | 7.36.0-r0 |
| Alpine 3.14 | curl | 7.36.0-r0 |
| Alpine 3.15 | curl | 7.36.0-r0 |
| Alpine 3.16 | curl | 7.36.0-r0 |
| Alpine 3.17 | curl | 7.36.0-r0 |
| Alpine 3.18 | curl | 7.36.0-r0 |
| Alpine 3.19 | curl | 7.36.0-r0 |
| Alpine 3.20 | curl | 7.36.0-r0 |
| Alpine 3.21 | curl | 7.36.0-r0 |
| Alpine 3.22 | curl | 7.36.0-r0 |
| Alpine 3.23 | curl | 7.36.0-r0 |
| Alpine 3.24 | curl | 7.36.0-r0 |
| Alpine 3.4 | curl | 7.36.0-r0 |
| Alpine 3.5 | curl | 7.36.0-r0 |
| Alpine 3.6 | curl | 7.36.0 |
| Alpine 3.7 | curl | 7.36.0 |
| Alpine 3.8 | curl | 7.36.0 |
| Alpine 3.9 | curl | 7.36.0-r0 |
| Debian 12 | curl | 7.36.0-1 |
| Debian 13 | curl | 7.36.0-1 |
| Debian 14 | curl | 7.36.0-1 |
| Debian 6.0 | curl | 7.21.0-2.1+squeeze8 |
| Debian 7 | curl | 7.26.0-1+wheezy9 |
| Red Hat Enterprise Linux 6 | curl | 0:7.19.7-37.el6_5.3 |
| Red Hat Enterprise Linux 6 | curl-debuginfo | 0:7.19.7-37.el6_5.3 |
| Red Hat Enterprise Linux 6 | libcurl | 0:7.19.7-37.el6_5.3 |
| Red Hat Enterprise Linux 6 | libcurl-devel | 0:7.19.7-37.el6_5.3 |
| openSUSE Tumbleweed | curl | 7.51.0-1.1 |