VULNERABILITY INTELLIGENCE
CVE-2024-2379
CVSS score6.3 MEDIUM
EPSS probability1.86%
CISA KEVNot currently listed
Published2024-03-27
Last modified2026-10-15
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Description
libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.
Weakness classification
- nvd@nist.gov: CWE-295
Primary references
- 2499f714-1537-4658-8207-48ae4bb9eae9 — Mailing List, Third Party Advisory
- 2499f714-1537-4658-8207-48ae4bb9eae9 — Mailing List, Third Party Advisory
- 2499f714-1537-4658-8207-48ae4bb9eae9 — Mailing List, Third Party Advisory
- 2499f714-1537-4658-8207-48ae4bb9eae9 — Mailing List, Third Party Advisory
- 2499f714-1537-4658-8207-48ae4bb9eae9 — Vendor Advisory
- 2499f714-1537-4658-8207-48ae4bb9eae9 — Vendor Advisory
- 2499f714-1537-4658-8207-48ae4bb9eae9 — Exploit, Issue Tracking, Third Party Advisory
- 2499f714-1537-4658-8207-48ae4bb9eae9 — Third Party Advisory
- 2499f714-1537-4658-8207-48ae4bb9eae9 — Release Notes, Vendor Advisory
- 2499f714-1537-4658-8207-48ae4bb9eae9 — Release Notes, Vendor Advisory
- 2499f714-1537-4658-8207-48ae4bb9eae9 — Release Notes, Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory