Orta CVSS 6.3 PoC var
CVE-2024-2379: Curl: güvenlik açığı
Açıklama (NVD)
libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.
Özet bilgiler
- Ürün
- Haxx Curl
- CVSS v3.1
- 6.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - EPSS
- %1,86 (yüzdelik 79)
- CWE
- CWE-295
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| haxx-curl | 8.6.0 | 8.6.0 | — |
| apple-macos | — | — | 12.7.6 |
| apple-macos | 13.0 | — | 13.6.8 |
| apple-macos | 14.0 | — | 14.6 |
| netapp-active-iq-unified-manager | — | — | — |
| netapp-ontap-select-deploy-administration-utility | — | — | — |
| netapp-h300s-firmware | — | — | — |
| netapp-h410s-firmware | — | — | — |
| netapp-h500s-firmware | — | — | — |
| netapp-h610c-firmware | — | — | — |
| netapp-h610s-firmware | — | — | — |
| netapp-h615c-firmware | — | — | — |
| netapp-h700s-firmware | — | — | — |
| netapp-bootstrap-os | — | — | — |
Kaynaklar
- NVD kaydı
- seclists.org
- seclists.org
- seclists.org
- www.openwall.com
- curl.se
- curl.se
- hackerone.com
- security.netapp.com
- support.apple.com
- support.apple.com
- support.apple.com
- seclists.org
- seclists.org
- seclists.org
- www.openwall.com
- curl.se
- curl.se
- hackerone.com
- security.netapp.com
- support.apple.com
- support.apple.com
- support.apple.com
- cert-portal.siemens.com
- cert-portal.siemens.com
- CWE-295