CVE-2024-2379

Опубликовано: 27 мар. 2024

Источник: nvd

CVSS3: 6.3

EPSS Низкий

Описание

libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.

Ссылки

http://seclists.org/fulldisclosure/2024/Jul/18
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2024/Jul/19
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2024/Jul/20
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/03/27/2
Mailing List
Third Party Advisory
https://curl.se/docs/CVE-2024-2379.html
Vendor Advisory
https://curl.se/docs/CVE-2024-2379.json
Vendor Advisory
https://hackerone.com/reports/2410774
Exploit
Issue Tracking
Third Party Advisory
https://security.netapp.com/advisory/ntap-20240531-0001/
Third Party Advisory
https://support.apple.com/kb/HT214118
Release Notes
Vendor Advisory
https://support.apple.com/kb/HT214119
Release Notes
Vendor Advisory
https://support.apple.com/kb/HT214120
Release Notes
Vendor Advisory
http://seclists.org/fulldisclosure/2024/Jul/18
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2024/Jul/19
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2024/Jul/20
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/03/27/2
Mailing List
Third Party Advisory
https://curl.se/docs/CVE-2024-2379.html
Vendor Advisory
https://curl.se/docs/CVE-2024-2379.json
Vendor Advisory
https://hackerone.com/reports/2410774
Exploit
Issue Tracking
Third Party Advisory
https://security.netapp.com/advisory/ntap-20240531-0001/
Third Party Advisory
https://support.apple.com/kb/HT214118
Release Notes
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:haxx:curl:8.6.0:*:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

Версия до 12.7.6 (исключая)

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

Версия от 13.0 (включая) до 13.6.8 (исключая)

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

Версия от 14.0 (включая) до 14.6 (исключая)

Конфигурация 3

Одно из

cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*

cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*

Конфигурация 4

Одновременно

cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

Конфигурация 5

Одновременно

cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*

Конфигурация 6

Одновременно

cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*

Конфигурация 7

Одновременно

cpe:2.3:o:netapp:h610c_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h610c:-:*:*:*:*:*:*:*

Конфигурация 8

Одновременно

cpe:2.3:o:netapp:h610s_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h610s:-:*:*:*:*:*:*:*

Конфигурация 9

Одновременно

cpe:2.3:o:netapp:h615c_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h615c:-:*:*:*:*:*:*:*

Конфигурация 10

Одновременно

cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*

Конфигурация 11

Одновременно

cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*

EPSS

Процентиль: 43%

0.00205

Низкий

6.3 Medium

CVSS3

Дефекты

CWE-295

Связанные уязвимости

CVE-2024-2379

CVSS3: 6.3

ubuntu

почти 2 года назад

CVE-2024-2379

CVSS3: 5.4

redhat

почти 2 года назад

CVE-2024-2379

msrc

больше 1 года назад

Описание отсутствует

CVE-2024-2379

CVSS3: 6.3

debian

почти 2 года назад

libcurl skips the certificate verification for a QUIC connection under ...

GHSA-wr4c-gwg7-p734

CVSS3: 6.3

github

почти 2 года назад

EPSS

Процентиль: 43%

0.00205

Низкий

6.3 Medium

CVSS3

Дефекты

CWE-295