QUIC certificate check bypass with wolfSSL

2024-03-2708:00:00

Google

osv.dev

libcurl

certificate verification

quic connection

wolfssl

software

security bypass

error path

unknown cipher

curve

verification

6 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

15.5%

JSON

libcurl skips the certificate verification for a QUIC connection under certain
conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or
curve, the error path accidentally skips the verification and returns OK, thus
ignoring any certificate problems.