CVE-2024-2466

Mô tả

Tham khảo

• seclists.org/fulldisclosure/2024/Jul/18 · Mailing List
• seclists.org/fulldisclosure/2024/Jul/19 · Mailing List
• seclists.org/fulldisclosure/2024/Jul/20 · Mailing List
• openwall.com/lists/oss-security/2024/03/27/4 · Mailing List
• curl.se/docs/CVE-2024-2466.html · Vendor Advisory
• curl.se/docs/CVE-2024-2466.json · Vendor Advisory
• hackerone.com/reports/2416725 · Exploit
• security.netapp.com/advisory/ntap-20240503-0010 · Third Party Advisory
• support.apple.com/kb/HT214118 · Release Notes
• support.apple.com/kb/HT214119 · Release Notes
• support.apple.com/kb/HT214120 · Release Notes
• vicarius.io/vsociety/posts/tls-certificate-check-bypass-curl-with-mbedtls-cve-2024-2466-2468 · Exploit

Lỗ hổng khác của curl

• CVE-2026-82209CAO 8.2When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where t…
• CVE-2026-82208CAO 7.5With the wolfSSL backend, when CA caching is enabled and an `CURLOPT_SSL_CTX_FUNCTION` callback replaces the trust store, libcurl can silent…
• CVE-2026-80255CAO 7.5A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute c…
• CVE-2026-80231CAO 7.5A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store…
• CVE-2026-80230CAO 7.5When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CU…