Lucene search

GoogleOSV:CURL-CVE-2024-2466

HistoryMar 27, 2024 - 8:00 a.m.

TLS certificate check bypass with mbedTLS

2024-03-2708:00:00

Google

osv.dev

tls certificate bypass

mbedtls

libcurl

ip address hosts

certificate check

software

https

ftps

imaps

pop3

smtps

5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

JSON

libcurl did not check the server certificate of TLS connections done to a host
specified as an IP address, when built to use mbedTLS.

libcurl would wrongly avoid using the set hostname function when the specified
hostname was given as an IP address, therefore completely skipping the
certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS,
POPS3, SMTPS, etc).

CPENameOperatorVersion
curl.giteq8.5.0
curl.giteq8.6.0

CPE	Name	Operator	Version
	curl.git	eq	8.5.0
	curl.git	eq	8.6.0