TLS certificate check bypass with mbedTLS
libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).
CVE-2024-2466
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2024-2466
curl
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "curl",
"product": "curl",
"versions": [
{
"status": "affected",
"version": "8.6.0",
"versionType": "semver",
"lessThanOrEqual": "8.6.0"
},
{
"status": "affected",
"version": "8.5.0",
"versionType": "semver",
"lessThanOrEqual": "8.5.0"
}
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2024-2466
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #26403 · Revision 1
- Added to Heist Feed
- Publisher date