libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.
Fix
Patch, vendor advisory and mitigation references on NVD 10
- https://curl.se/docs/CVE-2024-2379.html Vendor Advisory
- https://curl.se/docs/CVE-2024-2379.json Vendor Advisory
- https://support.apple.com/kb/HT214118 Release Notes, Vendor Advisory
- https://support.apple.com/kb/HT214119 Release Notes, Vendor Advisory
- https://support.apple.com/kb/HT214120 Release Notes, Vendor Advisory
- https://curl.se/docs/CVE-2024-2379.html Vendor Advisory
- https://curl.se/docs/CVE-2024-2379.json Vendor Advisory
- https://support.apple.com/kb/HT214118 Release Notes, Vendor Advisory
- https://support.apple.com/kb/HT214119 Release Notes, Vendor Advisory
- https://support.apple.com/kb/HT214120 Release Notes, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 6.3 · haxx, apple, netappNVD modified 2026-10-15 01:17
Affected (CPE criteria) 12
cpe:2.3:a:haxx:curl:8.6.0:*:*:*:*:*:*:*cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h610c_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h610s_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h615c_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*
References 25
- http://seclists.org/fulldisclosure/2024/Jul/18 Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2024/Jul/19 Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2024/Jul/20 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2024/03/27/2 Mailing List, Third Party Advisory
- https://curl.se/docs/CVE-2024-2379.html Vendor Advisory
- https://curl.se/docs/CVE-2024-2379.json Vendor Advisory
- https://hackerone.com/reports/2410774 Exploit, Issue Tracking, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20240531-0001/ Third Party Advisory
- https://support.apple.com/kb/HT214118 Release Notes, Vendor Advisory
- https://support.apple.com/kb/HT214119 Release Notes, Vendor Advisory
- https://support.apple.com/kb/HT214120 Release Notes, Vendor Advisory
- http://seclists.org/fulldisclosure/2024/Jul/18 Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2024/Jul/19 Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2024/Jul/20 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2024/03/27/2 Mailing List, Third Party Advisory
- https://curl.se/docs/CVE-2024-2379.html Vendor Advisory
- https://curl.se/docs/CVE-2024-2379.json Vendor Advisory
- https://hackerone.com/reports/2410774 Exploit, Issue Tracking, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20240531-0001/ Third Party Advisory
- https://support.apple.com/kb/HT214118 Release Notes, Vendor Advisory
- https://support.apple.com/kb/HT214119 Release Notes, Vendor Advisory
- https://support.apple.com/kb/HT214120 Release Notes, Vendor Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-331112.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://cert-portal.siemens.com/productcert/html/ssa-417159.html