CVE-2024-2379

2024-03-2708:15:41

Google

osv.dev

cve-2024-2379

libcurl

certificate verification

quic

wolfssl

cipher

curve

software

security bypass

6.6 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

15.8%

JSON

libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.

CPENameOperatorVersion
curleq7.74.0-1.3+deb11u4
curleq7.84.0-r1
curleq7.50.3-r1
curleq8.7.1-5~bpo12+1
curleq7.74.0-r0
curleq7.84.0-2
curleq7.28.1-r0
curleq7.83.1-r0
curleq7.79.1-r0
curleq7.67.0-r0

Name	Operator	Version
curl	eq	7.74.0-1.3+deb11u4
curl	eq	7.84.0-r1
curl	eq	7.50.3-r1
curl	eq	8.7.1-5~bpo12+1
curl	eq	7.74.0-r0
curl	eq	7.84.0-2
curl	eq	7.28.1-r0
curl	eq	7.83.1-r0
curl	eq	7.79.1-r0
curl	eq	7.67.0-r0