CVE-2024-2466 — Improper Validation of Certificate with Host Mismatch in Apple Macos
Severity
6.5MEDIUMNVD
EPSS
0.1%
top 64.52%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMar 27
Latest updateJul 29
Description
libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NExploitability: 3.9 | Impact: 2.5
Affected Packages4 packages
🔴Vulnerability Details
3GHSA▶
GHSA-9xr6-qf7m-2jv5: libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS↗2024-03-27
OSV▶
CVE-2024-2466: libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS↗2024-03-27