CVE-2024-2379
CVE-2024-2379 · QUIC certificate check bypass with wolfSSL
This page contains facts from public vulnerability sources. Check the original advisory before updating.
libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.
CVSS 6.3 · Medium · EPSS 1.9% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
curl
- Versions
- ≥ 8.6.0, ≤ 8.6.0: Affected (semver)
No fix published
curl Debian:12
- Versions
- 7.88.1-10
- 7.88.1-10+deb12u1
- 7.88.1-10+deb12u11
- 7.88.1-10+deb12u12
- 7.88.1-10+deb12u13
- 7.88.1-10+deb12u14
- 7.88.1-10+deb12u15
- 7.88.1-10+deb12u1~bpo11+1
- 7.88.1-10+deb12u2
- 7.88.1-10+deb12u3
- 7.88.1-10+deb12u3~bpo11+1
- 7.88.1-10+deb12u4
- 7.88.1-10+deb12u5
- 7.88.1-10+deb12u5~bpo11+1
- 7.88.1-10+deb12u6
- 7.88.1-10+deb12u6~bpo11+1
- 7.88.1-10+deb12u7
- 7.88.1-10+deb12u8
- 7.88.1-10+deb12u9
- 7.88.1-11
- 8.0.1-1~exp1
- 8.10.0-1
- 8.10.0-2
- 8.10.1-1
- 8.10.1-1~bpo12+1
- 8.10.1-2
- 8.11.0-1
- 8.11.1-1
- 8.11.1-1~bpo12+1
- 8.12.0+git20250209.89ed161+ds-1
- 8.12.0+git20250209.89ed161+ds-1~bpo12+1
- 8.12.1-1
- 8.12.1-2
- 8.12.1-2~bpo12+1
- 8.12.1-3
- 8.12.1-3~bpo12+1
- 8.13.0-1
- 8.13.0-1+exp1
- 8.13.0-2
- 8.13.0-2+exp1
- 8.13.0-3
- 8.13.0-4
- 8.13.0-4+exp1
- 8.13.0-5
- 8.13.0-5+exp1
- 8.13.0-5~bpo12+1
- 8.13.0~rc-1~exp1
- 8.13.0~rc-1~exp2
- 8.13.0~rc2-1
- 8.13.0~rc2-2
- 8.13.0~rc3-1
- 8.13.0~rc3-1+exp1
- 8.14.0-1
- 8.14.0-1+exp1
- 8.14.0~rc1-1+exp1
- 8.14.0~rc2-1+exp1
- 8.14.0~rc3-1+exp1
- 8.14.1-1
- 8.14.1-1~bpo12+1
- 8.14.1-2
- 8.14.1-2+exp1
- 8.14.1-2~bpo12+1
- 8.15.0-1
- 8.15.0-1~bpo13+1
- 8.15.0-1~exp1
- 8.15.0~rc1-1exp1
- 8.15.0~rc2-1~exp1
- 8.15.0~rc3-1~exp1
- 8.16.0-1
- 8.16.0-1+exp1
- 8.16.0-1~bpo13+1
- 8.16.0-2
- 8.16.0-3
- 8.16.0-4
- 8.16.0-4~bpo13+1
- 8.16.0~rc1-1~exp1
- 8.16.0~rc2-1
- 8.16.0~rc2-2
- 8.16.0~rc3-1
- 8.17.0-1
- 8.17.0-2
- 8.17.0-3
- 8.17.0~rc1-1~exp1
- 8.17.0~rc2-1
- 8.17.0~rc3-1
- 8.18.0-1
- 8.18.0-1~bpo13+1
- 8.18.0-2
- 8.18.0~rc1-1+exp1
- 8.18.0~rc2-1
- 8.18.0~rc3-1
- 8.19.0-1
- 8.19.0-1+exp1
- 8.19.0-1~bpo13+1
- 8.19.0-2
- 8.19.0-3
- 8.19.0-3+exp1
- 8.19.0-3+exp2
- 8.19.0~rc1-1~exp1
- 8.19.0~rc2-1
- 8.19.0~rc2-2
- 8.19.0~rc3-1
- 8.2.1-1
- 8.2.1-2
- 8.2.1-2~bpo12+1
- 8.20.0-1
- 8.20.0-1+exp
- 8.20.0-2
- 8.20.0-2+exp1
- 8.20.0-2~bpo13+1
- 8.20.0-3
- 8.20.0-4
- 8.20.0-5
- 8.20.0-5~bpo13+1
- 8.20.0~rc1-1+exp1
- 8.20.0~rc1-1+exp2
- 8.20.0~rc1-1+exp3
- 8.20.0~rc2-1
- 8.20.0~rc2-1+exp1
- 8.20.0~rc3-1
- 8.20.0~rc3-1+exp1
- 8.21.0-1
- 8.21.0-1+exp1
- 8.21.0-2
- 8.21.0-2+exp1
- 8.21.0-2~bpo13+1
- 8.21.0~rc1-1+exp1
- 8.21.0~rc2-1
- 8.21.0~rc2-1+exp1
- 8.21.0~rc3-1
- 8.21.0~rc3-1+exp1
- 8.22.0-1
- 8.22.0-1+exp1
- 8.22.0~rc2-1
- 8.22.0~rc2-2
- 8.22.0~rc3-1
- 8.22.0~rc3-1+exp1
- 8.23.0-1
- 8.23.0~rc1-1
- 8.23.0~rc1-2
- 8.23.0~rc2-1
- 8.23.0~rc2-1+exp1
- 8.23.0~rc3-1
- 8.23.0~rc3-1+exp1
- 8.3.0-1
- 8.3.0-2
- 8.3.0-2~bpo12+1
- 8.3.0-2~exp1
- 8.3.0-3
- 8.4.0-1
- 8.4.0-2
- 8.4.0-2~bpo12+1
- 8.5.0-1
- 8.5.0-1+exp1
- 8.5.0-2
- 8.5.0-2+exp1
- 8.5.0-2~bpo12+1
- 8.6.0-1
- 8.6.0-1.1
- 8.6.0-2
- 8.6.0-3
- 8.6.0-3.1
- 8.6.0-3.1~exp1
- 8.6.0-3.1~exp2
- 8.6.0-3.2
- 8.6.0-4
- 8.7.1-1
- 8.7.1-1+exp1
- 8.7.1-2
- 8.7.1-3
- 8.7.1-4
- 8.7.1-5
- 8.7.1-5+exp1
- 8.7.1-5~bpo12+1
- 8.8.0-1
- 8.8.0-1+exp1
- 8.8.0-1+exp2
- 8.8.0-1~bpo12+1
- 8.8.0-2
- 8.8.0-3
- 8.8.0-4
- 8.9.0-1
- 8.9.0-2
- 8.9.0-3
- 8.9.1-1
- 8.9.1-2
- 8.9.1-2~bpo12+1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
curl Debian:13
- Affected ranges
- ECOSYSTEM: < 8.7.1-1
Update to 8.7.1-1
curl Debian:14
- Affected ranges
- ECOSYSTEM: < 8.7.1-1
Update to 8.7.1-1
Original sources
- https://curl.se/docs/CVE-2024-2379.json
- https://curl.se/docs/CVE-2024-2379.html
- https://hackerone.com/reports/2410774
- http://www.openwall.com/lists/oss-security/2024/03/27/2
- https://security.netapp.com/advisory/ntap-20240531-0001/
- https://support.apple.com/kb/HT214119
- https://support.apple.com/kb/HT214118
- https://support.apple.com/kb/HT214120
- http://seclists.org/fulldisclosure/2024/Jul/20
- http://seclists.org/fulldisclosure/2024/Jul/18
- http://seclists.org/fulldisclosure/2024/Jul/19
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://cert-portal.siemens.com/productcert/html/ssa-417159.html
- https://cert-portal.siemens.com/productcert/html/ssa-331112.html
- https://nvd.nist.gov/vuln/detail/CVE-2024-2379