CVE-2024-2379

Published Mar 27, 2024

Last updated 9 months ago

Overview

Description
libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.
Source
2499f714-1537-4658-8207-48ae4bb9eae9
NVD status
Analyzed
Products
curl, macos, active_iq_unified_manager, ontap_select_deploy_administration_utility, h300s_firmware, h410s_firmware, h500s_firmware, h610c_firmware, h610s_firmware, h615c_firmware, h700s_firmware, bootstrap_os

Risk scores

CVSS 3.1

Type
Secondary
Base score
6.3
Impact score
3.4
Exploitability score
2.8
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Severity
MEDIUM

Weaknesses

nvd@nist.gov
CWE-295

Social media

Hype score
Not currently trending

Configurations