CVE-2024-2466

2024-03-2708:15:41

Debian Security Bug Tracker

security-tracker.debian.org

libcurl

tls

certificate

5.3 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.8%

JSON

libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).

OSVersionArchitecturePackageVersionFilename
Debian12allcurl< 7.88.1-10+deb12u6curl_7.88.1-10+deb12u6_all.deb
Debian11allcurl< 7.74.0-1.3+deb11u12curl_7.74.0-1.3+deb11u12_all.deb
Debian999allcurl< 8.7.1-1curl_8.7.1-1_all.deb
Debian13allcurl< 8.7.1-1curl_8.7.1-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	curl	< 7.88.1-10+deb12u6	curl_7.88.1-10+deb12u6_all.deb
Debian	11	all	curl	< 7.74.0-1.3+deb11u12	curl_7.74.0-1.3+deb11u12_all.deb
Debian	999	all	curl	< 8.7.1-1	curl_8.7.1-1_all.deb
Debian	13	all	curl	< 8.7.1-1	curl_8.7.1-1_all.deb