CVE-2024-2466

Опубликовано: 27 мар. 2024

Источник: nvd

CVSS3: 6.5

EPSS Низкий

Описание

libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).

Ссылки

http://seclists.org/fulldisclosure/2024/Jul/18
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2024/Jul/19
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2024/Jul/20
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/03/27/4
Mailing List
Third Party Advisory
https://curl.se/docs/CVE-2024-2466.html
Vendor Advisory
https://curl.se/docs/CVE-2024-2466.json
Vendor Advisory
https://hackerone.com/reports/2416725
Exploit
Issue Tracking
Third Party Advisory
https://security.netapp.com/advisory/ntap-20240503-0010/
Third Party Advisory
https://support.apple.com/kb/HT214118
Release Notes
Vendor Advisory
https://support.apple.com/kb/HT214119
Release Notes
Vendor Advisory
https://support.apple.com/kb/HT214120
Release Notes
Vendor Advisory
http://seclists.org/fulldisclosure/2024/Jul/18
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2024/Jul/19
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2024/Jul/20
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/03/27/4
Mailing List
Third Party Advisory
https://curl.se/docs/CVE-2024-2466.html
Vendor Advisory
https://curl.se/docs/CVE-2024-2466.json
Vendor Advisory
https://hackerone.com/reports/2416725
Exploit
Issue Tracking
Third Party Advisory
https://security.netapp.com/advisory/ntap-20240503-0010/
Third Party Advisory
https://support.apple.com/kb/HT214118
Release Notes
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*

Версия от 8.5.0 (включая) до 8.7.0 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

Версия до 12.7.6 (исключая)

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

Версия от 13.0 (включая) до 13.6.8 (исключая)

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

Версия от 14.0 (включая) до 14.6 (исключая)

Конфигурация 3

Одновременно

cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*

Конфигурация 4

Одновременно

cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*

Конфигурация 5

Одновременно

cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

Конфигурация 6

Одновременно

cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*

Конфигурация 7

Одновременно

cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*

EPSS

Процентиль: 36%

0.00149

Низкий

6.5 Medium

CVSS3

Дефекты

CWE-297

Связанные уязвимости

CVE-2024-2466

CVSS3: 6.5

ubuntu

почти 2 года назад

CVE-2024-2466

CVSS3: 5.3

redhat

почти 2 года назад

CVE-2024-2466

CVSS3: 6.5

msrc

больше 1 года назад

Описание отсутствует

CVE-2024-2466

CVSS3: 6.5

debian

почти 2 года назад

libcurl did not check the server certificate of TLS connections done t ...

GHSA-9xr6-qf7m-2jv5

CVSS3: 6.5

github

почти 2 года назад

EPSS

Процентиль: 36%

0.00149

Низкий

6.5 Medium

CVSS3

Дефекты

CWE-297