ByteOS Network

Vulnerability Details :

CVE-2024-2466

Assigner-curl

Assigner Org ID-2499f714-1537-4658-8207-48ae4bb9eae9

Published At-27 Mar, 2024 | 07:58

Updated At-13 Feb, 2025 | 17:40

TLS certificate check bypass with mbedTLS

libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:curl

Assigner Org ID:2499f714-1537-4658-8207-48ae4bb9eae9

Published At:27 Mar, 2024 | 07:58

Updated At:13 Feb, 2025 | 17:40

▼CVE Numbering Authority (CNA)

TLS certificate check bypass with mbedTLS

Affected Products

Vendor

CURL

Product

curl

Default Status

unaffected

Versions

Affected

From 8.6.0 through 8.6.0 (semver)
From 8.5.0 through 8.5.0 (semver)

Problem Types

Type	CWE ID	Description
N/A	N/A	CWE-297 Improper Validation of Certificate with Host Mismatch

Type: N/A

CWE ID: N/A

Description: CWE-297 Improper Validation of Certificate with Host Mismatch

Credits

finder

Frank Yueh

remediation developer

Stefan Eissing

References

Hyperlink	Resource
https://curl.se/docs/CVE-2024-2466.json	N/A
https://curl.se/docs/CVE-2024-2466.html	N/A
https://hackerone.com/reports/2416725	N/A
http://www.openwall.com/lists/oss-security/2024/03/27/4	N/A
https://security.netapp.com/advisory/ntap-20240503-0010/	N/A
https://support.apple.com/kb/HT214119	N/A
https://support.apple.com/kb/HT214118	N/A
https://support.apple.com/kb/HT214120	N/A
http://seclists.org/fulldisclosure/2024/Jul/20	N/A
http://seclists.org/fulldisclosure/2024/Jul/18	N/A
http://seclists.org/fulldisclosure/2024/Jul/19	N/A

Hyperlink: https://curl.se/docs/CVE-2024-2466.json

Resource: N/A

Hyperlink: https://curl.se/docs/CVE-2024-2466.html

Resource: N/A

Hyperlink: https://hackerone.com/reports/2416725

Resource: N/A

Hyperlink: http://www.openwall.com/lists/oss-security/2024/03/27/4

Resource: N/A

Hyperlink: https://security.netapp.com/advisory/ntap-20240503-0010/

Resource: N/A

Hyperlink: https://support.apple.com/kb/HT214119

Resource: N/A

Hyperlink: https://support.apple.com/kb/HT214118

Resource: N/A

Hyperlink: https://support.apple.com/kb/HT214120

Resource: N/A

Hyperlink: http://seclists.org/fulldisclosure/2024/Jul/20

Resource: N/A

Hyperlink: http://seclists.org/fulldisclosure/2024/Jul/18

Resource: N/A

Hyperlink: http://seclists.org/fulldisclosure/2024/Jul/19

Resource: N/A

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://curl.se/docs/CVE-2024-2466.json	x_transferred
https://curl.se/docs/CVE-2024-2466.html	x_transferred
https://hackerone.com/reports/2416725	x_transferred
http://www.openwall.com/lists/oss-security/2024/03/27/4	x_transferred
https://security.netapp.com/advisory/ntap-20240503-0010/	x_transferred
https://support.apple.com/kb/HT214119	x_transferred
https://support.apple.com/kb/HT214118	x_transferred
https://support.apple.com/kb/HT214120	x_transferred
http://seclists.org/fulldisclosure/2024/Jul/20	x_transferred
http://seclists.org/fulldisclosure/2024/Jul/18	x_transferred
http://seclists.org/fulldisclosure/2024/Jul/19	x_transferred
https://www.vicarius.io/vsociety/posts/tls-certificate-check-bypass-curl-with-mbedtls-cve-2024-2466-2468	N/A

Hyperlink: https://curl.se/docs/CVE-2024-2466.json

Resource:

x_transferred

Hyperlink: https://curl.se/docs/CVE-2024-2466.html

Resource:

x_transferred

Hyperlink: https://hackerone.com/reports/2416725

Resource:

x_transferred

Hyperlink: http://www.openwall.com/lists/oss-security/2024/03/27/4

Resource:

x_transferred

Hyperlink: https://security.netapp.com/advisory/ntap-20240503-0010/

Resource:

x_transferred

Hyperlink: https://support.apple.com/kb/HT214119

Resource:

x_transferred

Hyperlink: https://support.apple.com/kb/HT214118

Resource:

x_transferred

Hyperlink: https://support.apple.com/kb/HT214120

Resource:

x_transferred

Hyperlink: http://seclists.org/fulldisclosure/2024/Jul/20

Resource:

x_transferred

Hyperlink: http://seclists.org/fulldisclosure/2024/Jul/18

Resource:

x_transferred

Hyperlink: http://seclists.org/fulldisclosure/2024/Jul/19

Resource:

x_transferred

Hyperlink: https://www.vicarius.io/vsociety/posts/tls-certificate-check-bypass-curl-with-mbedtls-cve-2024-2466-2468

Resource: N/A

2. CISA ADP Vulnrichment

Affected Products

Vendor

CURL

Product

libcurl

CPEs

cpe:2.3:a:curl:libcurl:8.5.0:*:*:*:*:*:*:*

Default Status

unaffected

Versions

Affected

From 8.5.0 through 8.6.0 (custom)

Problem Types

Type	CWE ID	Description
CWE	CWE-297	CWE-297 Improper Validation of Certificate with Host Mismatch

Type: CWE

CWE ID: CWE-297

Description: CWE-297 Improper Validation of Certificate with Host Mismatch

Metrics

Version	Base score	Base severity	Vector
3.1	6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Version: 3.1

Base score: 6.5

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Metrics Other Info

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:2499f714-1537-4658-8207-48ae4bb9eae9

Published At:27 Mar, 2024 | 08:15

Updated At:30 Jul, 2025 | 19:42

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Type: Secondary

Version: 3.1

Base score: 6.5

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CPE Matches

CURL

>>curl>>Versions from 8.5.0(inclusive) to 8.7.0(exclusive)

cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*

Apple Inc.

>>macos>>Versions before 12.7.6(exclusive)

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

Apple Inc.

>>macos>>Versions from 13.0(inclusive) to 13.6.8(exclusive)

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

Apple Inc.

>>macos>>Versions from 14.0(inclusive) to 14.6(exclusive)

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

NetApp, Inc.

>>h700s_firmware>>-

cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*

NetApp, Inc.

>>h700s>>-

cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*

NetApp, Inc.

>>bootstrap_os>>-

cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*

NetApp, Inc.

>>hci_compute_node>>-

cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*

NetApp, Inc.

>>h300s_firmware>>-

cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*

NetApp, Inc.

>>h300s>>-

cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

NetApp, Inc.

>>h410s_firmware>>-

cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*

NetApp, Inc.

>>h410s>>-

cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*

NetApp, Inc.

>>h500s_firmware>>-

cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*

NetApp, Inc.

>>h500s>>-

cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-297	Secondary	134c704f-9b21-4f2e-91b3-4a467353bcc0

CWE ID: CWE-297

Type: Secondary

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

References

Hyperlink	Source	Resource
http://seclists.org/fulldisclosure/2024/Jul/18	2499f714-1537-4658-8207-48ae4bb9eae9	Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2024/Jul/19	2499f714-1537-4658-8207-48ae4bb9eae9	Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2024/Jul/20	2499f714-1537-4658-8207-48ae4bb9eae9	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/03/27/4	2499f714-1537-4658-8207-48ae4bb9eae9	Mailing List Third Party Advisory
https://curl.se/docs/CVE-2024-2466.html	2499f714-1537-4658-8207-48ae4bb9eae9	Vendor Advisory
https://curl.se/docs/CVE-2024-2466.json	2499f714-1537-4658-8207-48ae4bb9eae9	Vendor Advisory
https://hackerone.com/reports/2416725	2499f714-1537-4658-8207-48ae4bb9eae9	Exploit Issue Tracking Third Party Advisory
https://security.netapp.com/advisory/ntap-20240503-0010/	2499f714-1537-4658-8207-48ae4bb9eae9	Third Party Advisory
https://support.apple.com/kb/HT214118	2499f714-1537-4658-8207-48ae4bb9eae9	Release Notes Vendor Advisory
https://support.apple.com/kb/HT214119	2499f714-1537-4658-8207-48ae4bb9eae9	Release Notes Vendor Advisory
https://support.apple.com/kb/HT214120	2499f714-1537-4658-8207-48ae4bb9eae9	Release Notes Vendor Advisory
http://seclists.org/fulldisclosure/2024/Jul/18	af854a3a-2127-422b-91ae-364da2661108	Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2024/Jul/19	af854a3a-2127-422b-91ae-364da2661108	Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2024/Jul/20	af854a3a-2127-422b-91ae-364da2661108	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/03/27/4	af854a3a-2127-422b-91ae-364da2661108	Mailing List Third Party Advisory
https://curl.se/docs/CVE-2024-2466.html	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory
https://curl.se/docs/CVE-2024-2466.json	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory
https://hackerone.com/reports/2416725	af854a3a-2127-422b-91ae-364da2661108	Exploit Issue Tracking Third Party Advisory
https://security.netapp.com/advisory/ntap-20240503-0010/	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://support.apple.com/kb/HT214118	af854a3a-2127-422b-91ae-364da2661108	Release Notes Vendor Advisory
https://support.apple.com/kb/HT214119	af854a3a-2127-422b-91ae-364da2661108	Release Notes Vendor Advisory
https://support.apple.com/kb/HT214120	af854a3a-2127-422b-91ae-364da2661108	Release Notes Vendor Advisory
https://www.vicarius.io/vsociety/posts/tls-certificate-check-bypass-curl-with-mbedtls-cve-2024-2466-2468	af854a3a-2127-422b-91ae-364da2661108	Exploit Mitigation Third Party Advisory

Hyperlink: http://seclists.org/fulldisclosure/2024/Jul/18

Source: 2499f714-1537-4658-8207-48ae4bb9eae9

Resource:

Mailing List

Third Party Advisory

Hyperlink: http://seclists.org/fulldisclosure/2024/Jul/19

Source: 2499f714-1537-4658-8207-48ae4bb9eae9

Resource:

Mailing List

Third Party Advisory

Hyperlink: http://seclists.org/fulldisclosure/2024/Jul/20

Source: 2499f714-1537-4658-8207-48ae4bb9eae9

Resource:

Mailing List

Third Party Advisory

Hyperlink: http://www.openwall.com/lists/oss-security/2024/03/27/4

Source: 2499f714-1537-4658-8207-48ae4bb9eae9

Resource:

Mailing List

Third Party Advisory

Hyperlink: https://curl.se/docs/CVE-2024-2466.html

Source: 2499f714-1537-4658-8207-48ae4bb9eae9

Resource:

Vendor Advisory

Hyperlink: https://curl.se/docs/CVE-2024-2466.json

Source: 2499f714-1537-4658-8207-48ae4bb9eae9

Resource:

Vendor Advisory

Hyperlink: https://hackerone.com/reports/2416725

Source: 2499f714-1537-4658-8207-48ae4bb9eae9

Resource:

Exploit

Issue Tracking

Third Party Advisory

Hyperlink: https://security.netapp.com/advisory/ntap-20240503-0010/

Source: 2499f714-1537-4658-8207-48ae4bb9eae9

Resource:

Third Party Advisory

Hyperlink: https://support.apple.com/kb/HT214118

Source: 2499f714-1537-4658-8207-48ae4bb9eae9

Resource:

Release Notes

Vendor Advisory

Hyperlink: https://support.apple.com/kb/HT214119

Source: 2499f714-1537-4658-8207-48ae4bb9eae9

Resource:

Release Notes

Vendor Advisory

Hyperlink: https://support.apple.com/kb/HT214120

Source: 2499f714-1537-4658-8207-48ae4bb9eae9

Resource:

Release Notes

Vendor Advisory

Hyperlink: http://seclists.org/fulldisclosure/2024/Jul/18