CVE-2024-2466Improper Validation of Certificate with Host Mismatch in Apple Macos

Severity
6.5MEDIUMNVD
EPSS
0.1%
top 64.52%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMar 27
Latest updateJul 29

Description

libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NExploitability: 3.9 | Impact: 2.5

Affected Packages4 packages

NVDhaxx/curl8.5.08.7.0
NVDapple/macos13.013.6.8+2
Debianhaxx/curl< 8.7.1-1+1
CVEListV5curl/curl8.6.08.6.0+1

🔴Vulnerability Details

3
GHSA
GHSA-9xr6-qf7m-2jv5: libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS2024-03-27
CVEList
TLS certificate check bypass with mbedTLS2024-03-27
OSV
CVE-2024-2466: libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS2024-03-27

📋Vendor Advisories

6
Apple
CVE-2024-2466: macOS Sonoma 14.62024-07-29
Apple
CVE-2024-2466: macOS Ventura 13.6.82024-07-29
Apple
CVE-2024-2466: macOS Monterey 12.7.62024-07-29
Red Hat
curl: TLS certificate check bypass with mbedTLS2024-03-27
Microsoft
TLS certificate check bypass with mbedTLS2024-03-12

💬Community

2
HackerOne
CVE-2024-2466: TLS certificate check bypass with mbedTLS (reward request)2024-03-29
HackerOne
CVE-2024-2466: TLS certificate check bypass with mbedTLS2024-03-27
CVE-2024-2466 — Apple Macos vulnerability | cvebase