CVSS: 6.5EPSS: 0%CPEs: 86EXPL: 0CVE-2024-8096 – OCSP stapling bypass with GnuTLS
https://notcve.org/view.php?id=CVE-2024-8096
When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate. • https://curl.se/docs/CVE-2024-8096.json https://curl.se/docs/CVE-2024-8096.html https://hackerone.com/reports/2669852 • CWE-295: Improper Certificate Validation •
CVSS: -EPSS: 0%CPEs: 95EXPL: 0CVE-2024-7264 – ASN.1 date parser overread
https://notcve.org/view.php?id=CVE-2024-7264
libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the *time fraction*, leading to a `strlen()` getting performed on a pointer to a heap buffer area that is not (purposely) null terminated. This flaw most likely leads to a crash, but can also lead to heap contents getting returned to the application when [CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used. • https://curl.se/docs/CVE-2024-7264.html https://curl.se/docs/CVE-2024-7264.json https://hackerone.com/reports/2629968 http://www.openwall.com/lists/oss-security/2024/07/31/1 •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2024-6197 – freeing stack buffer in utf8asn1str
https://notcve.org/view.php?id=CVE-2024-6197
libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, when doing so it also invokes `free()` on a 4 byte localstack buffer. Most modern malloc implementations detect this error and immediately abort. Some however accept the input pointer and add that memory to its list of available chunks. • http://www.openwall.com/lists/oss-security/2024/07/24/1 http://www.openwall.com/lists/oss-security/2024/07/24/5 https://curl.se/docs/CVE-2024-6197.html https://curl.se/docs/CVE-2024-6197.json https://hackerone.com/reports/2559516 •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2024-2466 – TLS certificate check bypass with mbedTLS
https://notcve.org/view.php?id=CVE-2024-2466
libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc). libcurl no verificó el certificado del servidor de las conexiones TLS realizadas a un host especificado como dirección IP, cuando se creó para usar mbedTLS. libcurl evitaría erróneamente el uso de la función establecer nombre de host cuando el nombre de host especificado se proporcionara como dirección IP, por lo que se saltaría por completo la verificación del certificado. Esto afecta a todos los usos de los protocolos TLS (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc). A flaw was found in curl. • http://www.openwall.com/lists/oss-security/2024/03/27/4 https://curl.se/docs/CVE-2024-2466.html https://curl.se/docs/CVE-2024-2466.json https://hackerone.com/reports/2416725 https://security.netapp.com/advisory/ntap-20240503-0010 https://support.apple.com/kb/HT214119 https://support.apple.com/kb/HT214118 https://support.apple.com/kb/HT214120 http://seclists.org/fulldisclosure/2024/Jul/20 http://seclists.org/fulldisclosure/2024/Jul/18 http://seclists.org/ful • CWE-297: Improper Validation of Certificate with Host Mismatch •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-2379 – QUIC certificate check bypass with wolfSSL
https://notcve.org/view.php?id=CVE-2024-2379
libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems. libcurl omite la verificación del certificado para una conexión QUIC bajo ciertas condiciones, cuando está diseñado para usar wolfSSL. Si se le indica que utilice un cifrado o curva desconocido/incorrecto, la ruta de error omite accidentalmente la verificación y devuelve OK, ignorando así cualquier problema de certificado. A flaw was found in curl. When libcurl is built to use wolfSSL as the TLS backend, it skips certificate verification for a QUIC connection if an unknown/bad cipher or curve is used. • http://www.openwall.com/lists/oss-security/2024/03/27/2 https://curl.se/docs/CVE-2024-2379.html https://curl.se/docs/CVE-2024-2379.json https://hackerone.com/reports/2410774 https://security.netapp.com/advisory/ntap-20240531-0001 https://support.apple.com/kb/HT214119 https://support.apple.com/kb/HT214118 https://support.apple.com/kb/HT214120 http://seclists.org/fulldisclosure/2024/Jul/20 http://seclists.org/fulldisclosure/2024/Jul/18 http://seclists.org/ful • CWE-295: Improper Certificate Validation •