not verifying certs for TLS to IP address / Schannel

{
  "id": "1e26033fdd0363f1673a1096401d4b5b4bb0c41a878bd6ee9f9ff8538cb52ec3",
  "url": "https://osv.dev/vulnerability/CURL-CVE-2014-2522",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "not verifying certs for TLS to IP address / Schannel",
    "summary": "When asked to do a TLS connection (HTTPS, FTPS, IMAPS, etc) to a URL specified with an IP address instead of a name, libcurl would wrongly not verify the server's name in the certificate. The signature (whether it was signed by a trusted CA) and validity (whether the date was within the certificate's lifetime and it was not revoked) verification was still performed. This is a problem in libcurl built to use the Schannel TLS backend. Schannel is the native library provided by Microsoft Windows. Only users on Windows can be affected by this, and only if libcurl was built to use the native TLS backend library.",
    "evidence": "osv:CURL-CVE-2014-2522",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CURL-CVE-2014-2522",
      "aliases": [
        "CURL-CVE-2014-2522",
        "CVE-2014-2522"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "7.27.0"
                },
                {
                  "fixed": "7.36.0"
                }
              ]
            },
            {
              "repo": "https://github.com/curl/curl.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "aaa42aa0d594b95c6c670a373ba30c507aa0a5ed"
                },
                {
                  "fixed": "63fc8ee7be2b712e7af5029f4f8a86a0dfd71b38"
                }
              ]
            }
          ],
          "versions": [
            "7.35.0",
            "7.34.0",
            "7.33.0",
            "7.32.0",
            "7.31.0",
            "7.30.0",
            "7.29.0",
            "7.28.1",
            "7.28.0",
            "7.27.0",
            "curl-7_35_0",
            "curl-7_34_0",
            "curl-7_33_0",
            "curl-7_32_0",
            "curl-7_31_0",
            "curl-7_30_0",
            "curl-7_29_0",
            "curl-7_28_1",
            "curl-7_28_0",
            "curl-7_27_0"
          ],
          "database_specific": {
            "source": "https://curl.se/docs/CURL-CVE-2014-2522.json",
            "vanir_signatures": [
              {
                "id": "CURL-CVE-2014-2522-65f911ef",
                "digest": {
                  "length": 5212,
                  "function_hash": "201114652427706738740804130433342670756"
                },
                "source": "https://github.com/curl/curl.git/commit/63fc8ee7be2b712e7af5029f4f8a86a0dfd71b38",
                "target": {
                  "file": "lib/vtls/curl_schannel.c",
                  "function": "schannel_connect_step1"
                },
                "deprecated": false,
                "signature_type": "Function",
                "signature_version": "v1"
              },
              {
                "id": "CURL-CVE-2014-2522-72d96fcb",
                "digest": {
                  "threshold": 0.9,
                  "line_hashes": [
                    "37067894196444900397617705016039623743",
                    "161768383064884761262690179874875144343",
                    "82500998688114360303281786540641069544",
                    "289399917483318758033777927158434858866",
                    "332600585901512242754128816846775029390",
                    "96034512906067914464259407389070079807",
                    "248455268525012668894381651065346837303",
                    "252858979942174794365535322041206415414",
                    "36255879304211910177030073595527677586",
                    "65508394054464198753753981692666982439",
                    "107607901544107254571541286663980946099",
                    "281175509784847119433452659265058060331",
                    "220146253374254298395958640922488755668",
                    "128202501759524298133555426942877081053",
                    "293810268716254750755126383521910622768"
                  ]
                },
                "source": "https://github.com/curl/curl.git/commit/63fc8ee7be2b712e7af5029f4f8a86a0dfd71b38",
                "target": {
                  "file": "lib/vtls/curl_schannel.c"
                },
                "deprecated": false,
                "signature_type": "Line",
                "signature_version": "v1"
              }
            ],
            "vanir_signatures_modified": "2026-10-26T13:07:54Z"
          }
        }
      ],
      "modified": "2026-10-26T13:07:54.126737817Z",
      "provider": "osv",
      "references": [],
      "provider_metadata": {
        "CWE": {
          "id": "CWE-297",
          "desc": "Improper Validation of Certificate with Host Mismatch"
        },
        "URL": "https://curl.se/docs/CVE-2014-2522.json",
        "www": "https://curl.se/docs/CVE-2014-2522.html",
        "affects": "both",
        "package": "curl",
        "severity": "Medium",
        "last_affected": "7.35.0"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2014-2522",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/database_specific/severity"
  },
  "source_id": "core-osv",
  "document_id": 453275,
  "published_at": "2014-03-26T08:00:00+00:00"
}