CURL-CVE-2024-2379

See a problem?
Please try reporting it to the source first.
Source
https://curl.se/docs/CVE-2024-2379.html
Import Source
https://curl.se/docs/CURL-CVE-2024-2379.json
JSON Data
https://api.osv.dev/v1/vulns/CURL-CVE-2024-2379
Aliases
Published
2024-03-27T08:00:00Z
Modified
2024-03-27T07:12:10.631249Z
Summary
QUIC certificate check bypass with wolfSSL
Details

libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.

Database specific 
{
    "www": "https://curl.se/docs/CVE-2024-2379.html",
    "issue": "https://hackerone.com/reports/2410774",
    "award": {
        "currency": "USD",
        "amount": "540"
    },
    "severity": "Low",
    "last_affected": "8.6.0",
    "package": "curl",
    "affects": "both",
    "CWE": {
        "id": "CWE-295",
        "desc": "Improper Certificate Validation"
    },
    "URL": "https://curl.se/docs/CVE-2024-2379.json"
}
References
Credits
    • Dexter Gerig - FINDER
    • Daniel Stenberg - REMEDIATION_DEVELOPER

Affected packages

Git / github.com/curl/curl.git

Affected ranges

Type
SEMVER
Events
Introduced
8.6.0
Fixed
8.7.0
Type
GIT
Repo
https://github.com/curl/curl.git
Events
Introduced
5d044ad9480a9f556f4b6a252d7533b1ba7fe57e
Fixed
aedbbdf18e689a5eee8dc39600914f5eda6c409c

Affected versions

8.*

8.6.0

Database specific

vanir_signatures

[
    {
        "id": "CURL-CVE-2024-2379-4dbeed5c",
        "deprecated": false,
        "signature_version": "v1",
        "source": "https://github.com/curl/curl.git/commit/aedbbdf18e689a5eee8dc39600914f5eda6c409c",
        "target": {
            "function": "curl_wssl_init_ctx",
            "file": "lib/vquic/vquic-tls.c"
        },
        "digest": {
            "length": 2335.0,
            "function_hash": "308331943041861371639039538192042483189"
        },
        "signature_type": "Function"
    },
    {
        "id": "CURL-CVE-2024-2379-5f54d04e",
        "deprecated": false,
        "signature_version": "v1",
        "source": "https://github.com/curl/curl.git/commit/aedbbdf18e689a5eee8dc39600914f5eda6c409c",
        "target": {
            "file": "lib/vquic/vquic-tls.c"
        },
        "digest": {
            "line_hashes": [
                "304710802608863144525034776543861387669",
                "152849649950337135313138391605629341153",
                "87232486737253111567709053838971761644",
                "301176537118206019688446296485190556977",
                "227298720867210619994722286404526464743",
                "320580059432211571039891998163312159337",
                "126589234890986545332356183811704963214",
                "225157769788319158074990015026053240328",
                "217887743343146381480822658135552967292",
                "34586074150797236395501072178400680375",
                "8058249062824325069705209579206231951",
                "257931542921577543445064989776379055335",
                "319170056292468850829997776446338885613",
                "175102669095967882189577713037523353419",
                "28866816341477307423168021789210657964",
                "258973118936269985264340322446427215516"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line"
    }
]