CVE-2024-2466

MEDIO 6.5CVE-2024-2466 · Published 27/03/2024 · updated 15/10/2026

In breve

CVE-2024-2466 è una vulnerabilità MEDIO (CVSS 6.5) che riguarda curl (haxx).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.5%, superiore al 73.4% delle vulnerabilità.
Correzione: aggiornare a 8.7.0 o successiva.

Package	Affected versions	Patched versions
curl haxx	`≥ 8.5.0, < 8.7.0`	`8.7.0`

Description

libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).

References

seclists.org/fulldisclosure/2024/Jul/18 · Mailing List
seclists.org/fulldisclosure/2024/Jul/19 · Mailing List
seclists.org/fulldisclosure/2024/Jul/20 · Mailing List
openwall.com/lists/oss-security/2024/03/27/4 · Mailing List
curl.se/docs/CVE-2024-2466.html · Vendor Advisory
curl.se/docs/CVE-2024-2466.json · Vendor Advisory
hackerone.com/reports/2416725 · Exploit
security.netapp.com/advisory/ntap-20240503-0010 · Third Party Advisory
support.apple.com/kb/HT214118 · Release Notes
support.apple.com/kb/HT214119 · Release Notes
support.apple.com/kb/HT214120 · Release Notes
vicarius.io/vsociety/posts/tls-certificate-check-bypass-curl-with-mbedtls-cve-2024-2466-2468 · Exploit

Altre vulnerabilità di curl

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

curl

haxx

≥ 8.5.0, < 8.7.0

8.7.0

Description

Altre vulnerabilità di curl

Vedi tutto →