6.3
Moyenne
CVE-2024-2379 libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL
Description
libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| curl | 8.6.0 | Pas de correctif indiqué |
| SIMATIC S7-1500 CPU 1518-4 PN/DP MFP 3.1 | 3.1.0 → < 3.1.5 | 3.1.5 |
| SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP 3.1 | 3.1.0 → < 3.1.5 | 3.1.5 |
| SINEMA Remote Connect Client | Versions non publiées | |
| SIPLUS S7-1500 CPU 1518-4 PN/DP MFP 3.1 | 3.1.0 → < 3.1.5 | 3.1.5 |
| SINEC NMS | Versions non publiées |
Références
- json curl.se
- www curl.se
- issue hackerone.com
- www.openwall.com www.openwall.com
- security.netapp.com security.netapp.com
- support.apple.com support.apple.com
- support.apple.com support.apple.com
- support.apple.com support.apple.com
- seclists.org seclists.org
- seclists.org seclists.org
- seclists.org seclists.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de curl
Les 98 CVE de curl →
CVE-2026-107929
When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes…
8.1
Élevée
CVE-2026-107928
When curl is built with GnuTLS, a malicious WebSocket server can make curl
send memory past its send buffer
8.1
Élevée
CVE-2026-94266
libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing…
7.5
Élevée
CVE-2026-94265
When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might…
9.1
Critique