CVE-2024-2379
Assigner: curl
Published: 2024-03-27T07:56:41.158Z
State: PUBLISHED
title: QUIC certificate check bypass with wolfSSL
descriptions: value: libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.
problemTypes: descriptions: description: CWE-295 Improper Certificate Validation 
affected: vendor: curl
product: curl
versions: version: 8.6.0
status: affected
lessThanOrEqual: 8.6.0
versionType: semver
defaultStatus: unaffected
credits: value: Dexter Gerig
type: finder
value: Daniel Stenberg
type: remediation developer