CVE-2024-2379 — Improper Certificate Validation in Apple Macos

CWE-295 — Improper Certificate Validation12 documents9 sources
Severity
6.3MEDIUMNVD
EPSS
0.2%
top 57.27%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Haxx CurlApple MacosCurl
Timeline
PublishedMar 27
Latest updateJul 29

Description

libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:LExploitability: 2.8 | Impact: 3.4

Affected Packages4 packages

▶NVDapple/macos13.0 — 13.6.8+2
▶Debianhaxx/curl< 8.7.1-1+1
▶CVEListV5curl/curl8.6.0 — 8.6.0
▶NVDhaxx/curl8.6.0

🔴Vulnerability Details

3
OSV
CVE-2024-2379: libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL↗2024-03-27
▶
CVEList
QUIC certificate check bypass with wolfSSL↗2024-03-27
▶
GHSA
GHSA-wr4c-gwg7-p734: libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL↗2024-03-27
▶

📋Vendor Advisories

6
Apple
CVE-2024-2379: macOS Ventura 13.6.8↗2024-07-29
▶
Apple
CVE-2024-2379: macOS Sonoma 14.6↗2024-07-29
▶
Apple
CVE-2024-2379: macOS Monterey 12.7.6↗2024-07-29
▶
Red Hat
curl: QUIC certificate check bypass with wolfSSL↗2024-03-27
▶
Microsoft
QUIC certificate check bypass with wolfSSL↗2024-03-12
▶

💬Community

2
HackerOne
CVE-2024-2379: QUIC certificate check bypass with wolfSSL↗2024-03-29
▶
HackerOne
CVE-2024-2379: QUIC certificate check bypass with wolfSSL↗2024-03-27
▶
CVE-2024-2379 — Improper Certificate Validation | cvebase