CVSS: 6.5EPSS: 0%CPEs: 86EXPL: 0CVE-2024-8096 – OCSP stapling bypass with GnuTLS
https://notcve.org/view.php?id=CVE-2024-8096
When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate. • https://curl.se/docs/CVE-2024-8096.json https://curl.se/docs/CVE-2024-8096.html https://hackerone.com/reports/2669852 • CWE-295: Improper Certificate Validation •
CVSS: -EPSS: 0%CPEs: 95EXPL: 0CVE-2024-7264 – ASN.1 date parser overread
https://notcve.org/view.php?id=CVE-2024-7264
libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the *time fraction*, leading to a `strlen()` getting performed on a pointer to a heap buffer area that is not (purposely) null terminated. This flaw most likely leads to a crash, but can also lead to heap contents getting returned to the application when [CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used. • https://curl.se/docs/CVE-2024-7264.html https://curl.se/docs/CVE-2024-7264.json https://hackerone.com/reports/2629968 http://www.openwall.com/lists/oss-security/2024/07/31/1 •
CVSS: 3.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-6874 – macidn punycode buffer overread
https://notcve.org/view.php?id=CVE-2024-6874
libcurl's URL API function [curl_url_get()](https://curl.se/libcurl/c/curl_url_get.html) offers punycode conversions, to and from IDN. Asking to convert a name that is exactly 256 bytes, libcurl ends up reading outside of a stack based buffer when built to use the *macidn* IDN backend. The conversion function then fills up the provided buffer exactly - but does not null terminate the string. This flaw can lead to stack contents accidently getting returned as part of the converted string. La función API de URL de libcurl [curl_url_get()](https://curl.se/libcurl/c/curl_url_get.html) ofrece conversiones punycode, hacia y desde IDN. Al solicitar convertir un nombre que tiene exactamente 256 bytes, libcurl termina leyendo fuera de un búfer en la región stack de la memoria cuando se construye para usar el backend IDN *macidn*. • http://www.openwall.com/lists/oss-security/2024/07/24/2 https://curl.se/docs/CVE-2024-6874.html https://curl.se/docs/CVE-2024-6874.json https://hackerone.com/reports/2604391 •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2024-6197 – freeing stack buffer in utf8asn1str
https://notcve.org/view.php?id=CVE-2024-6197
libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, when doing so it also invokes `free()` on a 4 byte localstack buffer. Most modern malloc implementations detect this error and immediately abort. Some however accept the input pointer and add that memory to its list of available chunks. • http://www.openwall.com/lists/oss-security/2024/07/24/1 http://www.openwall.com/lists/oss-security/2024/07/24/5 https://curl.se/docs/CVE-2024-6197.html https://curl.se/docs/CVE-2024-6197.json https://hackerone.com/reports/2559516 •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2024-2466 – TLS certificate check bypass with mbedTLS
https://notcve.org/view.php?id=CVE-2024-2466
libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc). libcurl no verificó el certificado del servidor de las conexiones TLS realizadas a un host especificado como dirección IP, cuando se creó para usar mbedTLS. libcurl evitaría erróneamente el uso de la función establecer nombre de host cuando el nombre de host especificado se proporcionara como dirección IP, por lo que se saltaría por completo la verificación del certificado. Esto afecta a todos los usos de los protocolos TLS (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc). A flaw was found in curl. • http://www.openwall.com/lists/oss-security/2024/03/27/4 https://curl.se/docs/CVE-2024-2466.html https://curl.se/docs/CVE-2024-2466.json https://hackerone.com/reports/2416725 https://security.netapp.com/advisory/ntap-20240503-0010 https://support.apple.com/kb/HT214119 https://support.apple.com/kb/HT214118 https://support.apple.com/kb/HT214120 http://seclists.org/fulldisclosure/2024/Jul/20 http://seclists.org/fulldisclosure/2024/Jul/18 http://seclists.org/ful • CWE-297: Improper Validation of Certificate with Host Mismatch •