CVE-2024-2379

Public on 2024-03-27

Modified on 2024-03-28

Description

libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.

Severity

Medium

See what this means

CVSS v3 Base Score

5.4

See breakdown

Affected Packages

Platform	Package	Status
Amazon Linux 1	curl	Not Affected
Amazon Linux 2 - Core	curl	Not Affected
Amazon Linux 2023	curl	Not Affected

CVSS Scores

	Score Type	Score	Vector
Amazon Linux	CVSSv3	5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
NVD	CVSSv3	6.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

References

FAQs regarding Amazon Linux ALAS/CVE Severity Red Hat: CVE-2024-2379 Mitre: CVE-2024-2379