Aller au contenu
en Se connecter
6.5 Moyenne

CVE-2024-2466 libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to…

Description

libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).

Produits et versions touchés

Produit Versions touchées Corrigé en
curl 8.6.0 Pas de correctif indiqué
curl 8.5.0 Pas de correctif indiqué
libcurl 8.5 8.5.0 → 8.6.0 Pas de correctif indiqué
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP 3.1 3.1.0 → < 3.1.5 3.1.5
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP 3.1 3.1.0 → < 3.1.5 3.1.5
SINEMA Remote Connect Client Versions non publiées
SIPLUS S7-1500 CPU 1518-4 PN/DP MFP 3.1 3.1.0 → < 3.1.5 3.1.5
SINEC NMS Versions non publiées

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de curl

Les 98 CVE de curl →
CVE-2026-107929 When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes… 8.1 Élevée CVE-2026-107928 When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer 8.1 Élevée CVE-2026-94266 libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing… 7.5 Élevée CVE-2026-94265 When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might… 9.1 Critique
Suivre cette CVE