CVE-2024-2379

MEDIUM

curl - Improper Certificate Validation in wolfSSL QUIC Connection

Title source: llm
STIX 2.1

Description

libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.

References (11)

Core 11
Core References
Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2024/Jul/18
Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2024/Jul/19
Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2024/Jul/20
Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/03/27/2
Exploit, Issue Tracking, Third Party Advisory
https://hackerone.com/reports/2410774
Release Notes, Vendor Advisory
https://support.apple.com/kb/HT214118
Release Notes, Vendor Advisory
https://support.apple.com/kb/HT214119
Release Notes, Vendor Advisory
https://support.apple.com/kb/HT214120

Scores

CVSS v3 6.3
EPSS 0.0021
EPSS Percentile 42.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-295
Status published
Products (12)
apple/macos < 12.7.6
haxx/curl 8.6.0
netapp/active_iq_unified_manager
netapp/bootstrap_os
netapp/h300s_firmware
netapp/h410s_firmware
netapp/h500s_firmware
netapp/h610c_firmware
netapp/h610s_firmware
netapp/h615c_firmware
... and 2 more
Published Mar 27, 2024
Tracked Since Feb 18, 2026