Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2024-2379

Good to know:

icon

Date: March 27, 2024

libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.

Language: C

Severity Score

Related Resources (9)

https://github.com/curl/curl/commit/aedbbdf18e689a5eee8dc396
https://curl.se/docs/CVE-2024-2379.json
https://security-tracker.debian.org/tracker/CVE-2024-2379
https://curl.se/docs/CVE-2024-2379.html
https://hackerone.com/reports/2410774
https://nvd.nist.gov/vuln/detail/CVE-2024-2379
https://seclists.org/oss-sec/2024/q1/254
http://www.openwall.com/lists/oss-security/2024/03/27/2
https://www.mend.io/vulnerability-database/CVE-2024-2379

Severity Score

Top Fix

icon

Upgrade Version

Upgrade to version curl-8_7_0

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): LOW
Integrity (I): NONE
Availability (A): NONE

Do you need more information?

Contact Us