{
  "schema_version": "1.5.0",
  "id": "CURL-CVE-2014-1263",
  "aliases": [
    "CVE-2014-1263"
  ],
  "summary": "not verifying certs for TLS to IP address / Secure Transport",
  "modified": "2026-04-25T17:48:46.00Z",
  "database_specific": {
    "package": "curl",
    "affects": "both",
    "URL": "https://curl.se/docs/CVE-2014-1263.json",
    "www": "https://curl.se/docs/CVE-2014-1263.html",
    "CWE": {
      "id": "CWE-297",
      "desc": "Improper Validation of Certificate with Host Mismatch"
    },
    "last_affected": "7.35.0",
    "severity": "Medium"
  },
  "published": "2014-03-26T08:00:00.00Z",
  "affected": [
    {
      "ranges": [
        {
           "type": "SEMVER",
           "events": [
             {"introduced": "7.27.0"},
             {"fixed": "7.36.0"}
           ]
        },
        {
           "type": "GIT",
           "repo": "https://github.com/curl/curl.git",
           "events": [
             {"introduced": "6d1ea388cbd9de7f2a944a0c64f5feaec1b1904a"},
             {"fixed": "afc6e5004fabee590e41ffe750a237e1187fbbbd"}
           ]
        }
      ],
      "versions": [
        "7.35.0", "7.34.0", "7.33.0", "7.32.0", "7.31.0", "7.30.0", "7.29.0", 
        "7.28.1", "7.28.0", "7.27.0"
      ]
    }
  ],
  "credits": [
    {
      "name": "Roland Moriz",
      "type": "FINDER"
    },
    {
      "name": "David Ryskalczyk",
      "type": "REMEDIATION_DEVELOPER"
    },
    {
      "name": "Nick Zitzmann",
      "type": "OTHER"
    }
  ],
  "details": "When asked to do a TLS connection (HTTPS, FTPS, IMAPS, etc) to a URL specified\nwith an IP address instead of a name, libcurl would wrongly not verify the\nserver's name in the certificate. The signature (whether it was signed by a\ntrusted CA) and validity (whether the date was within the certificate's\nlifetime and it was not revoked) verification was still performed.\n\nThis is a problem in libcurl built to use the Secure Transport backend. Secure\nTransport is the TLS library present and used on Mac OS X and iOS.\n\nOnly users on Mac OS X or iOS can be affected by this, and only if libcurl was\nbuilt to use the native TLS backend library.\n\nThis problem was initially used as an example of the Apple SSL bug that hit\n[the news in late February\n2014](https://www.imperialviolet.org/2014/02/22/applebug.html) but that was\nnot correct."
}