← Back

CVE-2024-2466

nvd nist
Published: Mar 27, 2024Modified: Jun 17, 2026

JSON object

Loading...
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Exploitability: 3.9 / Impact: 2.5
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).

Affected (9)

Haxx
1 product
Curl
Apple
1 product
Macos
Netapp
5 products
H700s Firmware
Bootstrap Os
H300s Firmware
H410s Firmware
H500s Firmware
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Curl
From 8.5.0 to 8.7.0
Configuration B
3 vulnerable
Vulnerable SoftwareAffected Versions
Apple
Macos
Before 12.7.6
Macos
From 13.0 to 13.6.8
Macos
From 14.0 to 14.6
Configuration C
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
H700s Firmware
All versions
Running on/withPlatform Versions
Netapp
H700s
All versions
Configuration D
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Bootstrap Os
All versions
Running on/withPlatform Versions
Netapp
Hci Compute Node
All versions
Configuration E
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
H300s Firmware
All versions
Running on/withPlatform Versions
Netapp
H300s
All versions
Configuration F
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
H410s Firmware
All versions
Running on/withPlatform Versions
Netapp
H410s
All versions
Configuration G
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
H500s Firmware
All versions
Running on/withPlatform Versions
Netapp
H500s
All versions

Related CWEs

CWE-297
Improper Validation of Certificate with Host Mismatch
The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.

References (23)

Source: 2499f714-1537-4658-8207-48ae4bb9eae9
Mailing ListThird Party Advisory
Source: 2499f714-1537-4658-8207-48ae4bb9eae9
Mailing ListThird Party Advisory
Source: 2499f714-1537-4658-8207-48ae4bb9eae9
Mailing ListThird Party Advisory
Source: 2499f714-1537-4658-8207-48ae4bb9eae9
Mailing ListThird Party Advisory
Source: 2499f714-1537-4658-8207-48ae4bb9eae9
Vendor Advisory
Source: 2499f714-1537-4658-8207-48ae4bb9eae9
Vendor Advisory
Source: 2499f714-1537-4658-8207-48ae4bb9eae9
ExploitIssue TrackingThird Party Advisory
Source: 2499f714-1537-4658-8207-48ae4bb9eae9
Third Party Advisory
Source: 2499f714-1537-4658-8207-48ae4bb9eae9
Release NotesVendor Advisory
Source: 2499f714-1537-4658-8207-48ae4bb9eae9
Release NotesVendor Advisory
Source: 2499f714-1537-4658-8207-48ae4bb9eae9
Release NotesVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitIssue TrackingThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Release NotesVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Release NotesVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Release NotesVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitMitigationThird Party Advisory

Timeline

No history available yet.