CVE-2024-2379
QUIC certificate check bypass with wolfSSL
libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
QUIC certificate check bypass with wolfSSL
libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.
- Record
CVE-2024-2379- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
EUVDEUVD-2024-27332
libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.
- Record
EUVD-2024-27332- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-wr4c-gwg7-p734
libcurl skips the certificate verification for a QUIC connection under certain conditions, when...
libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.
- Record
GHSA-wr4c-gwg7-p734- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-295
- Updated
- 2026-11-02
NVD
libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.
- Record
CVE-2024-2379- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-295
- Updated
- 2026-11-02
OSVALPINE-CVE-2024-2379
libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.
- Record
ALPINE-CVE-2024-2379- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVBELL-CVE-2024-2379
- Record
BELL-CVE-2024-2379- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
Show 10 moreShow less
OSV
QUIC certificate check bypass with wolfSSL
libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.
- Record
CVE-2024-2379- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-2379
libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.
- Record
DEBIAN-CVE-2024-2379- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVJLSEC-2026-415
libcurl skips the certificate verification for a QUIC connection under certain conditions, when...
libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.
- Record
JLSEC-2026-415- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVRHSA-2024:2693
Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP4 security update
- Record
RHSA-2024:2693- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-42966 No score
CVE-2024-2379 affecting package cmake for versions less than 3.30.3-2
libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.
- Record
AZL-42966- Updated
- 2026-11-02
OSVCURL-CVE-2024-2379 No score
QUIC certificate check bypass with wolfSSL
libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.
- Record
CURL-CVE-2024-2379- Updated
- 2026-11-02
OSVMGASA-2024-0099 No score
Updated curl packages fix security vulnerabilities
CVE-2024-2004: Usage of disabled protocol If all protocols are disabled at run-time with none being added, curl/libcurl would still allow communication with the default set of allowed protocols, including some that are unencrypted. CVE-2024-2398: HTTP/2 push headers memory-leak A memory leak could occur when an application enabled HTTP/2 server push and the server sent a large number of headers.
- Record
MGASA-2024-0099- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13805-1 No score
curl-8.7.1-1.1 on GA media
These are all security issues fixed in the curl-8.7.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13805-1- Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2024-2379 No score
CVE-2024-2379 in curl - Patched by Root
Root has patched CVE-2024-2379 in the curl package for Root:Debian:12. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-12-CVE-2024-2379- Updated
- 2026-11-04
OSVSUSE-SU-2025:20029-1 No score
Security update for curl
This update for curl fixes the following issues:
Security issues fixed:
- CVE-2024-7264: ASN.1 date parser overread (bsc#1228535)
- CVE-2024-6197: Freeing stack buffer in utf8asn1str (bsc#1227888)
- CVE-2024-2379: QUIC certificate check bypass with wolfSSL (bsc#1221666)
- CVE-2024-2466: TLS certificate check bypass with mbedTLS (bsc#1221668)
- CVE-2024-2004: Usage of disabled protocol (bsc#1221665)
- CVE-2024-2398: HTTP/2 push headers memory-leak (bsc#1221667)
Non-security issue fixed:
- Fixed various TLS related issues including FTP over SSL transmission timeouts.
- Record
SUSE-SU-2025:20029-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
curlAlpine:v3.17 |
before 8.7.1-r0 | 8.7.1-r0 |
curlAlpine:v3.18 |
before 8.7.1-r0 | 8.7.1-r0 |
curlAlpine:v3.19 |
before 8.7.1-r0 | 8.7.1-r0 |
curlAlpine:v3.20 |
before 8.7.1-r0 | 8.7.1-r0 |
curlAlpine:v3.21 |
before 8.7.1-r0 | 8.7.1-r0 |
curlAlpine:v3.22 |
before 8.7.1-r0 | 8.7.1-r0 |
curlAlpine:v3.23 |
before 8.7.1-r0 | 8.7.1-r0 |
curlAlpine:v3.24 |
before 8.7.1-r0 | 8.7.1-r0 |
cmakeAzure Linux:3 |
before 3.30.3-2 | 3.30.3-2 |
curlAlpaquita:stream |
8.6.0-r0 up to 8.7.1-r0 | 8.7.1-r0 |
Show 73 moreShow less
| Package | Affected | Fixed |
|---|---|---|
curlBellSoft Hardened Containers:stream |
8.6.0-r0 up to 8.7.1-r0 | 8.7.1-r0 |
curlDebian:12 |
All versions, plus listed versions 7.88.1-107.88.1-10+deb12u17.88.1-10+deb12u117.88.1-10+deb12u127.88.1-10+deb12u13 Show 45 moreShow less7.88.1-10+deb12u147.88.1-10+deb12u157.88.1-10+deb12u1~bpo11+17.88.1-10+deb12u27.88.1-10+deb12u37.88.1-10+deb12u3~bpo11+17.88.1-10+deb12u47.88.1-10+deb12u57.88.1-10+deb12u5~bpo11+17.88.1-10+deb12u67.88.1-10+deb12u6~bpo11+17.88.1-10+deb12u77.88.1-10+deb12u87.88.1-10+deb12u97.88.1-118.0.1-1~exp18.10.0-18.10.0-28.10.1-18.10.1-1~bpo12+18.10.1-28.11.0-18.11.1-18.11.1-1~bpo12+18.12.0+git20250209.89ed161+ds-18.12.0+git20250209.89ed161+ds-1~bpo12+18.12.1-18.12.1-28.12.1-2~bpo12+18.12.1-38.12.1-3~bpo12+18.13.0-18.13.0-1+exp18.13.0-28.13.0-2+exp18.13.0-38.13.0-48.13.0-4+exp18.13.0-58.13.0-5+exp18.13.0-5~bpo12+18.13.0~rc-1~exp18.13.0~rc-1~exp28.13.0~rc2-18.13.0~rc2-2 |
None known |
curlDebian:13 |
before 8.7.1-1 | 8.7.1-1 |
curlDebian:14 |
before 8.7.1-1 | 8.7.1-1 |
CURL_jllJulia |
8.6.0+0 up to 8.9.0+0 | 8.9.0+0 |
LibCURL_jllJulia |
8.6.0+0 up to 8.7.1+0 | 8.7.1+0 |
curlMageia:9 From an advisory covering 4 CVEs |
before 7.88.1-4.3.mga9 | 7.88.1-4.3.mga9 |
jbcs-httpd24-curlRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:8.7.1-2.el7jbcs | 0:8.7.1-2.el7jbcs |
jbcs-httpd24-curl-debuginfoRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:8.7.1-2.el7jbcs | 0:8.7.1-2.el7jbcs |
jbcs-httpd24-httpdRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:2.4.57-10.el7jbcs | 0:2.4.57-10.el7jbcs |
jbcs-httpd24-httpd-debuginfoRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:2.4.57-10.el7jbcs | 0:2.4.57-10.el7jbcs |
jbcs-httpd24-httpd-develRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:2.4.57-10.el7jbcs | 0:2.4.57-10.el7jbcs |
jbcs-httpd24-httpd-manualRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:2.4.57-10.el7jbcs | 0:2.4.57-10.el7jbcs |
jbcs-httpd24-httpd-selinuxRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:2.4.57-10.el7jbcs | 0:2.4.57-10.el7jbcs |
jbcs-httpd24-httpd-toolsRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:2.4.57-10.el7jbcs | 0:2.4.57-10.el7jbcs |
jbcs-httpd24-libcurlRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:8.7.1-2.el7jbcs | 0:8.7.1-2.el7jbcs |
jbcs-httpd24-libcurl-develRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:8.7.1-2.el7jbcs | 0:8.7.1-2.el7jbcs |
jbcs-httpd24-mod_http2Red Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:1.15.19-37.el7jbcs | 0:1.15.19-37.el7jbcs |
jbcs-httpd24-mod_http2-debuginfoRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:1.15.19-37.el7jbcs | 0:1.15.19-37.el7jbcs |
jbcs-httpd24-mod_jkRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:1.2.49-6.redhat_1.el7jbcs | 0:1.2.49-6.redhat_1.el7jbcs |
jbcs-httpd24-mod_jk-ap24Red Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:1.2.49-6.redhat_1.el7jbcs | 0:1.2.49-6.redhat_1.el7jbcs |
jbcs-httpd24-mod_jk-debuginfoRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:1.2.49-6.redhat_1.el7jbcs | 0:1.2.49-6.redhat_1.el7jbcs |
jbcs-httpd24-mod_ldapRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:2.4.57-10.el7jbcs | 0:2.4.57-10.el7jbcs |
jbcs-httpd24-mod_mdRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 1:2.4.24-6.el7jbcs | 1:2.4.24-6.el7jbcs |
jbcs-httpd24-mod_md-debuginfoRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 1:2.4.24-6.el7jbcs | 1:2.4.24-6.el7jbcs |
jbcs-httpd24-mod_proxy_clusterRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:1.3.20-4.el7jbcs | 0:1.3.20-4.el7jbcs |
jbcs-httpd24-mod_proxy_cluster-debuginfoRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:1.3.20-4.el7jbcs | 0:1.3.20-4.el7jbcs |
jbcs-httpd24-mod_proxy_htmlRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 1:2.4.57-10.el7jbcs | 1:2.4.57-10.el7jbcs |
jbcs-httpd24-mod_securityRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:2.9.3-36.el7jbcs | 0:2.9.3-36.el7jbcs |
jbcs-httpd24-mod_security-debuginfoRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:2.9.3-36.el7jbcs | 0:2.9.3-36.el7jbcs |
jbcs-httpd24-mod_sessionRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:2.4.57-10.el7jbcs | 0:2.4.57-10.el7jbcs |
jbcs-httpd24-mod_sslRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 1:2.4.57-10.el7jbcs | 1:2.4.57-10.el7jbcs |
jbcs-httpd24-nghttp2Red Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:1.43.0-13.el7jbcs | 0:1.43.0-13.el7jbcs |
jbcs-httpd24-nghttp2-debuginfoRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:1.43.0-13.el7jbcs | 0:1.43.0-13.el7jbcs |
jbcs-httpd24-nghttp2-develRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs |
before 0:1.43.0-13.el7jbcs | 0:1.43.0-13.el7jbcs |
jbcs-httpd24-curlRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:8.7.1-2.el8jbcs | 0:8.7.1-2.el8jbcs |
jbcs-httpd24-curl-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:8.7.1-2.el8jbcs | 0:8.7.1-2.el8jbcs |
jbcs-httpd24-httpdRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:2.4.57-10.el8jbcs | 0:2.4.57-10.el8jbcs |
jbcs-httpd24-httpd-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:2.4.57-10.el8jbcs | 0:2.4.57-10.el8jbcs |
jbcs-httpd24-httpd-develRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:2.4.57-10.el8jbcs | 0:2.4.57-10.el8jbcs |
jbcs-httpd24-httpd-manualRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:2.4.57-10.el8jbcs | 0:2.4.57-10.el8jbcs |
jbcs-httpd24-httpd-selinuxRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:2.4.57-10.el8jbcs | 0:2.4.57-10.el8jbcs |
jbcs-httpd24-httpd-toolsRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:2.4.57-10.el8jbcs | 0:2.4.57-10.el8jbcs |
jbcs-httpd24-httpd-tools-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:2.4.57-10.el8jbcs | 0:2.4.57-10.el8jbcs |
jbcs-httpd24-libcurlRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:8.7.1-2.el8jbcs | 0:8.7.1-2.el8jbcs |
jbcs-httpd24-libcurl-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:8.7.1-2.el8jbcs | 0:8.7.1-2.el8jbcs |
jbcs-httpd24-libcurl-develRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:8.7.1-2.el8jbcs | 0:8.7.1-2.el8jbcs |
jbcs-httpd24-mod_http2Red Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:1.15.19-37.el8jbcs | 0:1.15.19-37.el8jbcs |
jbcs-httpd24-mod_http2-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:1.15.19-37.el8jbcs | 0:1.15.19-37.el8jbcs |
jbcs-httpd24-mod_jkRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:1.2.49-6.redhat_1.el8jbcs | 0:1.2.49-6.redhat_1.el8jbcs |
jbcs-httpd24-mod_jk-ap24Red Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:1.2.49-6.redhat_1.el8jbcs | 0:1.2.49-6.redhat_1.el8jbcs |
jbcs-httpd24-mod_jk-ap24-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:1.2.49-6.redhat_1.el8jbcs | 0:1.2.49-6.redhat_1.el8jbcs |
jbcs-httpd24-mod_ldapRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:2.4.57-10.el8jbcs | 0:2.4.57-10.el8jbcs |
jbcs-httpd24-mod_ldap-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:2.4.57-10.el8jbcs | 0:2.4.57-10.el8jbcs |
jbcs-httpd24-mod_mdRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 1:2.4.24-6.el8jbcs | 1:2.4.24-6.el8jbcs |
jbcs-httpd24-mod_md-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 1:2.4.24-6.el8jbcs | 1:2.4.24-6.el8jbcs |
jbcs-httpd24-mod_proxy_clusterRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:1.3.20-4.el8jbcs | 0:1.3.20-4.el8jbcs |
jbcs-httpd24-mod_proxy_cluster-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:1.3.20-4.el8jbcs | 0:1.3.20-4.el8jbcs |
jbcs-httpd24-mod_proxy_htmlRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 1:2.4.57-10.el8jbcs | 1:2.4.57-10.el8jbcs |
jbcs-httpd24-mod_proxy_html-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 1:2.4.57-10.el8jbcs | 1:2.4.57-10.el8jbcs |
jbcs-httpd24-mod_securityRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:2.9.3-36.el8jbcs | 0:2.9.3-36.el8jbcs |
jbcs-httpd24-mod_security-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:2.9.3-36.el8jbcs | 0:2.9.3-36.el8jbcs |
jbcs-httpd24-mod_sessionRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:2.4.57-10.el8jbcs | 0:2.4.57-10.el8jbcs |
jbcs-httpd24-mod_session-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:2.4.57-10.el8jbcs | 0:2.4.57-10.el8jbcs |
jbcs-httpd24-mod_sslRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 1:2.4.57-10.el8jbcs | 1:2.4.57-10.el8jbcs |
jbcs-httpd24-mod_ssl-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 1:2.4.57-10.el8jbcs | 1:2.4.57-10.el8jbcs |
jbcs-httpd24-nghttp2Red Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:1.43.0-13.el8jbcs | 0:1.43.0-13.el8jbcs |
jbcs-httpd24-nghttp2-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:1.43.0-13.el8jbcs | 0:1.43.0-13.el8jbcs |
jbcs-httpd24-nghttp2-develRed Hat:jboss_core_services:1::el8 From an advisory covering 6 CVEs |
before 0:1.43.0-13.el8jbcs | 0:1.43.0-13.el8jbcs |
curlRoot:Debian:12 |
before 7.88.1-10+deb12u14.root.io.11 | 7.88.1-10+deb12u14.root.io.117.88.1-10+deb12u14.root.io.107.88.1-10+deb12u15.aikido.137.88.1-10+deb12u15.aikido.147.88.1-10+deb12u15.aikido.157.88.1-10+deb12u15.aikido.167.88.1-10+deb12u15.aikido.177.88.1-10+deb12u15.aikido.187.88.1-10+deb12u15.aikido.197.88.1-10+deb12u15.aikido.20 |
rootio-curlRoot:Debian:12 |
before 7.88.1-10+deb12u14.root.io.11 | 7.88.1-10+deb12u14.root.io.117.88.1-10+deb12u14.root.io.107.88.1-10+deb12u15.aikido.137.88.1-10+deb12u15.aikido.147.88.1-10+deb12u15.aikido.157.88.1-10+deb12u15.aikido.167.88.1-10+deb12u15.aikido.177.88.1-10+deb12u15.aikido.187.88.1-10+deb12u15.aikido.197.88.1-10+deb12u15.aikido.20 |
curlSUSE:Linux Micro 6.0 From an advisory covering 6 CVEs |
before 8.6.0-3.1 | 8.6.0-3.1 |
curlopenSUSE:Tumbleweed From an advisory covering 4 CVEs |
before 8.7.1-1.1 | 8.7.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| affected, facts | OSV | |
| affected | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-2379 is a medium vulnerability (CVSS 6.3) in Curl, published March 27, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.86%, the 79th percentile. Fixed in curl 8.7.1-r0.
References
curl.se/docs/CVE-2024-2379.json
hackerone.com/reports/2410774
openwall.com/lists/oss-security/2024/03/27/2
security.netapp.com/advisory/ntap-20240531-0001
support.apple.com/kb/HT214119
Show 63 moreShow less
seclists.org/fulldisclosure/2024/Jul/20
cert-portal.siemens.com/productcert/html/ssa-398330.html
nvd.nist.gov/vuln/detail/CVE-2024-2379
github.com/advisories/GHSA-wr4c-gwg7-p734
security.alpinelinux.org/vuln/CVE-2024-2379
docs.bell-sw.com/security/cves/CVE-2024-2379
security-tracker.debian.org/tracker/CVE-2024-2379
advisories.mageia.org/MGASA-2024-0099.html
bugs.mageia.org/show_bug.cgi?id=33020
access.redhat.com/errata/RHSA-2024:2693
bugzilla.redhat.com/show_bug.cgi?id=2268277
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2693.json
cve.org/CVERecord?id=CVE-2024-2004
httpd.apache.org/security/vulnerabilities_24.html
nowotarski.info/http2-continuation-flood
kb.cert.org/vuls/id/421644
suse.com/support/update/announcement/2025/suse-su-202520029-1
bugzilla.suse.com/1221665
Left out here: 137 versions. The JSON record has them.