libcurl Skips Certificate Check for TLS Connections When Using mbedTLS
CVE-2024-2466

6.5MEDIUM

Key Information:

Vendor

Curl

Status
Curl
Vendor
CVE Published:
27 March 2024

What is CVE-2024-2466?

libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).

Affected Version(s)

curl 8.6.0

curl 8.5.0

References

https://curl.se/docs/CVE-2024-2466.json
https://curl.se/docs/CVE-2024-2466.html
https://hackerone.com/reports/2416725

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Frank Yueh
Stefan Eissing
.