CVE-2024-2379

2024-03-2708:15:41

Debian Security Bug Tracker

security-tracker.debian.org

libcurl

certificate verification

quic

wolfssl

unix

unknown cipher

curve

error path

security issue

6.6 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

15.8%

JSON

libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.

OSVersionArchitecturePackageVersionFilename
Debian12allcurl<= 7.88.1-10+deb12u6curl_7.88.1-10+deb12u6_all.deb
Debian11allcurl<= 7.74.0-1.3+deb11u12curl_7.74.0-1.3+deb11u12_all.deb
Debian999allcurl< 8.7.1-1curl_8.7.1-1_all.deb
Debian13allcurl< 8.7.1-1curl_8.7.1-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	curl	<= 7.88.1-10+deb12u6	curl_7.88.1-10+deb12u6_all.deb
Debian	11	all	curl	<= 7.74.0-1.3+deb11u12	curl_7.74.0-1.3+deb11u12_all.deb
Debian	999	all	curl	< 8.7.1-1	curl_8.7.1-1_all.deb
Debian	13	all	curl	< 8.7.1-1	curl_8.7.1-1_all.deb