CVE-2014-8151
Publication date 15 January 2015
Last updated 24 July 2024
Ubuntu priority
The darwinssl_connect_step1 function in lib/vtls/curl_darwinssl.c in libcurl 7.31.0 through 7.39.0, when using the DarwinSSL (aka SecureTransport) back-end for TLS, does not check if a cached TLS session validated the certificate when reusing the session, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| curl | ||
| 14.04 LTS trusty |
Not affected
|
|