QUIC certificate check bypass with wolfSSL

2024-03-2708:00:00

Google

osv.dev

libcurl

certificate verification

quic connection

wolfssl

software

security bypass

error path

unknown cipher

curve

verification

AI Score

Confidence

Low

EPSS

Percentile

13.5%

JSON

libcurl skips the certificate verification for a QUIC connection under certain
conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or
curve, the error path accidentally skips the verification and returns OK, thus
ignoring any certificate problems.

alpinelinux 1

hackerone 2

nessus 9

veracode 1

cve 1

osv 3

vulnrichment 1

wolfi 1

nvd 1

ubuntucve 1

cvelist 1

redhatcve 1