CVE-2014-8150

Description

CRLF injection vulnerability in libcurl 6.0 through 7.x before 7.40.0, when using an HTTP proxy, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a URL.

4.3

CVSS

Severity: Medium

CVSS 2.0 •

EPSS 2.41% Top 20%

Vendor Advisory fedoraproject.org Vendor Advisory fedoraproject.org Vendor Advisory apple.com Vendor Advisory redhat.com Vendor Advisory opensuse.org Vendor Advisory fedoraproject.org Vendor Advisory ubuntu.com Vendor Advisory gentoo.org Vendor Advisory fedoraproject.org Vendor Advisory mandriva.com Vendor Advisory debian.org Vendor Advisory haxx.se

Affected: n/a n/a

References

Link	Tags
http://secunia.com/advisories/62361	third party advisory
https://kc.mcafee.com/corporate/index?page=content&id=SB10131
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157188.html	vendor advisory
http://advisories.mageia.org/MGASA-2015-0020.html
http://www.securityfocus.com/bid/71964	vdb entry
http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html
http://www.securitytracker.com/id/1032768	vdb entry
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147856.html	vendor advisory
http://curl.haxx.se/docs/adv_20150108B.html	vendor advisory
http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html	vendor advisory
http://rhn.redhat.com/errata/RHSA-2015-1254.html	vendor advisory
http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743
http://lists.opensuse.org/opensuse-updates/2015-02/msg00040.html	vendor advisory
https://support.apple.com/kb/HT205031
http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147876.html	vendor advisory
http://www.ubuntu.com/usn/USN-2474-1	vendor advisory
https://security.gentoo.org/glsa/201701-47	vendor advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/156945.html	vendor advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2015:021	vendor advisory
http://secunia.com/advisories/62075	third party advisory
http://www.debian.org/security/2015/dsa-3122	vendor advisory
http://secunia.com/advisories/61925	third party advisory

Frequently Asked Questions

What is the severity of CVE-2014-8150?: CVE-2014-8150 has been scored as a medium severity vulnerability.
How to fix CVE-2014-8150?: To fix CVE-2014-8150, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2014-8150 being actively exploited in the wild?: It is possible that CVE-2014-8150 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~2% probability that this vulnerability will be exploited by malicious actors in the next 30 days.