Home > Vulnerability Database > CVE-2024-2379

Mend.io Vulnerability Database

CVE-2024-2379

Date: March 27, 2024

libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.

Language: C

Severity Score

6.3

Related Resources (16)

Url: https://github.com/curl/curl/commit/aedbbdf18e689a5eee8dc396

Url: https://curl.se/docs/CVE-2024-2379.json

Url: https://support.apple.com/kb/HT214118

Url: https://curl.se/docs/CVE-2024-2379.html

Url: http://seclists.org/fulldisclosure/2024/Jul/18

Url: https://hackerone.com/reports/2410774

Url: http://seclists.org/fulldisclosure/2024/Jul/19

Url: https://support.apple.com/kb/HT214119

Url: https://security-tracker.debian.org/tracker/CVE-2024-2379

Url: https://nvd.nist.gov/vuln/detail/CVE-2024-2379

Url: https://support.apple.com/kb/HT214120

Url: http://seclists.org/fulldisclosure/2024/Jul/20

Url: https://security.netapp.com/advisory/ntap-20240531-0001/

Url: https://seclists.org/oss-sec/2024/q1/254

Url: http://www.openwall.com/lists/oss-security/2024/03/27/2

Url: https://www.mend.io/vulnerability-database/CVE-2024-2379

Severity Score

6.3

Weakness Type (CWE)

Improper Certificate Validation

CWE-295

CVSS v3.1

Base Score:	6.3
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	REQUIRED
Scope (S):	UNCHANGED
Confidentiality (C):	LOW
Integrity (I):	LOW
Availability (A):	LOW

Mend.io Vulnerability Database

We found results for “”

CVE-2024-2379

Date: March 27, 2024

Language: C

Severity Score

Related Resources (16)

Severity Score

Weakness Type (CWE)

CVSS v3.1

Do you need more information?