libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when…
Medium CVSS 6.5
Summary
libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
- :
- :
- :
- :
- :
- :
Sources
- NVD DATABASE
Original Links
- http://seclists.org/fulldisclosure/2024/Jul/18 Mailing List
- http://seclists.org/fulldisclosure/2024/Jul/19 Mailing List
- http://seclists.org/fulldisclosure/2024/Jul/20 Mailing List
- http://www.openwall.com/lists/oss-security/2024/03/27/4 Mailing List
- https://curl.se/docs/CVE-2024-2466.html Vendor Advisory
- https://curl.se/docs/CVE-2024-2466.json Vendor Advisory
- https://hackerone.com/reports/2416725 Exploit
- https://security.netapp.com/advisory/ntap-20240503-0010/ Third Party Advisory
- https://support.apple.com/kb/HT214118 Release Notes
- https://support.apple.com/kb/HT214119 Release Notes
- https://support.apple.com/kb/HT214120 Release Notes
- http://seclists.org/fulldisclosure/2024/Jul/18 Mailing List
- http://seclists.org/fulldisclosure/2024/Jul/19 Mailing List
- http://seclists.org/fulldisclosure/2024/Jul/20 Mailing List
- http://www.openwall.com/lists/oss-security/2024/03/27/4 Mailing List
- https://curl.se/docs/CVE-2024-2466.html Vendor Advisory
- https://curl.se/docs/CVE-2024-2466.json Vendor Advisory
- https://hackerone.com/reports/2416725 Exploit
- https://security.netapp.com/advisory/ntap-20240503-0010/ Third Party Advisory
- https://support.apple.com/kb/HT214118 Release Notes
- https://support.apple.com/kb/HT214119 Release Notes
- https://support.apple.com/kb/HT214120 Release Notes
- https://www.vicarius.io/vsociety/posts/tls-certificate-check-bypass-curl-with-mbedtls-cve-2024-2466-2468 Exploit
- https://cert-portal.siemens.com/productcert/html/ssa-331112.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://cert-portal.siemens.com/productcert/html/ssa-417159.html
Timeline
- nvd_ingest NVD