CVE-2024-2466

CVE-2024-2466

Name

CVE-2024-2466

Description

libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).

NVD Severity

unknown

Other trackers

CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia

Mailing lists

oss-security, full-disclosure, bugtraq

Exploits

Exploit DB, Metasploit

Forges

GitHub (code, issues), Aports (code, issues)

Type	URI
2499f714-1537-4658-8207-48ae4bb9eae9	https://curl.se/docs/CVE-2024-2466.html
2499f714-1537-4658-8207-48ae4bb9eae9	https://curl.se/docs/CVE-2024-2466.json
2499f714-1537-4658-8207-48ae4bb9eae9	https://hackerone.com/reports/2416725
2499f714-1537-4658-8207-48ae4bb9eae9	http://www.openwall.com/lists/oss-security/2024/03/27/4
2499f714-1537-4658-8207-48ae4bb9eae9	https://security.netapp.com/advisory/ntap-20240503-0010/
	https://support.apple.com/kb/HT214119
	https://support.apple.com/kb/HT214118
	https://support.apple.com/kb/HT214120
	http://seclists.org/fulldisclosure/2024/Jul/20
	http://seclists.org/fulldisclosure/2024/Jul/18
	http://seclists.org/fulldisclosure/2024/Jul/19

Type

URI