CVE-2024-2379
MEDIUMCVSS 6.3/10EPSS 1.71%
Last modified
CVE-2024-2379 is a medium-severity vulnerability rated 6.3/10 on the CVSS scale. libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.. EPSS estimates a 1.71% chance of exploitation in the next 30 days.
Description
libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Haxx | Curl | 8.6.0 |
| Apple | Macos | < 12.7.6 |
| Apple | Macos | >= 13.0, < 13.6.8 |
| Apple | Macos | >= 14.0, < 14.6 |
| Netapp | Active Iq Unified Manager | All versions |
| Netapp | Ontap Select Deploy Administration Utility | All versions |
| Netapp | H300s Firmware | All versions |
| Netapp | H410s Firmware | All versions |
| Netapp | H500s Firmware | All versions |
| Netapp | H610c Firmware | All versions |
| Netapp | H610s Firmware | All versions |
| Netapp | H615c Firmware | All versions |
| Netapp | H700s Firmware | All versions |
| Netapp | Bootstrap Os | All versions |
References
- http://seclists.org/fulldisclosure/2024/Jul/18Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2024/Jul/19Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2024/Jul/20Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2024/03/27/2Mailing List, Third Party Advisory
- https://curl.se/docs/CVE-2024-2379.htmlVendor Advisory
- https://curl.se/docs/CVE-2024-2379.jsonVendor Advisory
- https://hackerone.com/reports/2410774Exploit, Issue Tracking, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20240531-0001/Third Party Advisory
- https://support.apple.com/kb/HT214118Release Notes, Vendor Advisory
- https://support.apple.com/kb/HT214119Release Notes, Vendor Advisory
- https://support.apple.com/kb/HT214120Release Notes, Vendor Advisory
- http://seclists.org/fulldisclosure/2024/Jul/18Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2024/Jul/19Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2024/Jul/20Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2024/03/27/2Mailing List, Third Party Advisory
- https://curl.se/docs/CVE-2024-2379.htmlVendor Advisory
- https://curl.se/docs/CVE-2024-2379.jsonVendor Advisory
- https://hackerone.com/reports/2410774Exploit, Issue Tracking, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20240531-0001/Third Party Advisory
- https://support.apple.com/kb/HT214118Release Notes, Vendor Advisory
- https://support.apple.com/kb/HT214119Release Notes, Vendor Advisory
- https://support.apple.com/kb/HT214120Release Notes, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-2379?
libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.
How severe is CVE-2024-2379?
CVE-2024-2379 has a CVSS score of 6.3/10 (MEDIUM severity). The EPSS model estimates a 1.71% probability of exploitation in the next 30 days.
How do I fix CVE-2024-2379?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-23784Improper access control vulnerability exists in Energy Manag…6.5
- CVE-2024-23785Cross-site request forgery vulnerability in Energy Managemen…6.5
- CVE-2024-23786Cross-site scripting vulnerability in Energy Management Cont…9.3
- CVE-2024-23787Path traversal vulnerability in Energy Management Controller…6.5
- CVE-2024-23788Server-side request forgery vulnerability in Energy Manageme…8.1
- CVE-2024-23789Energy Management Controller with Cloud Services JH-RVB1 /JH…8.8
- CVE-2024-23790Improper Input Validation vulnerability in the upload functi…9.8
- CVE-2024-23791Insertion of debug information into log file during building…7.5
- CVE-2024-23792When adding attachments to ticket comments, another user ca…6.5
- CVE-2024-23793The file upload feature in OTRS and ((OTRS)) Community Editi…6.3
- CVE-2024-23794An incorrect privilege assignment vulnerability in the inlin…7.5
- CVE-2024-23795A vulnerability has been identified in Tecnomatix Plant Simu…7.8
Are you affected by CVE-2024-2379?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST