CVE-2014-8150
Fixed in a distro release EPSS 7%
CRLF injection vulnerability in libcurl 6.0 through 7.x before 7.40.0, when using an HTTP proxy, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a URL.
Products: debian_linux, haxx libcurl, canonical ubuntu_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | curl | 7.38.0-4 |
| Debian 13 | curl | 7.38.0-4 |
| Debian 14 | curl | 7.38.0-4 |
| Debian 6.0 | curl | 7.21.0-2.1+squeeze11 |
| Debian 7 | curl | 7.26.0-1+wheezy12 |
| Red Hat Enterprise Linux 6 | curl | 0:7.19.7-46.el6 |
| Red Hat Enterprise Linux 6 | curl-debuginfo | 0:7.19.7-46.el6 |
| Red Hat Enterprise Linux 6 | libcurl | 0:7.19.7-46.el6 |
| Red Hat Enterprise Linux 6 | libcurl-devel | 0:7.19.7-46.el6 |
| Red Hat Enterprise Linux 7 | curl | 0:7.29.0-25.el7 |
| Red Hat Enterprise Linux 7 | curl-debuginfo | 0:7.29.0-25.el7 |
| Red Hat Enterprise Linux 7 | libcurl | 0:7.29.0-25.el7 |
| Red Hat Enterprise Linux 7 | libcurl-devel | 0:7.29.0-25.el7 |
| Ubuntu 14.04 LTS | curl | 7.35.0-1ubuntu2.3 |
| openSUSE Tumbleweed | curl | 7.51.0-1.1 |