libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.
{ "severity": "Low", "last_affected": "8.6.0", "affects": "both", "package": "curl", "issue": "https://hackerone.com/reports/2410774", "URL": "https://curl.se/docs/CVE-2024-2379.json", "CWE": { "id": "CWE-295", "desc": "Improper Certificate Validation" }, "award": { "amount": "540", "currency": "USD" }, "www": "https://curl.se/docs/CVE-2024-2379.html" }
{ "vanir_signatures": [ { "digest": { "function_hash": "308331943041861371639039538192042483189", "length": 2335.0 }, "id": "CURL-CVE-2024-2379-4dbeed5c", "source": "https://github.com/curl/curl.git/commit/aedbbdf18e689a5eee8dc39600914f5eda6c409c", "signature_version": "v1", "signature_type": "Function", "target": { "file": "lib/vquic/vquic-tls.c", "function": "curl_wssl_init_ctx" }, "deprecated": false }, { "digest": { "threshold": 0.9, "line_hashes": [ "304710802608863144525034776543861387669", "152849649950337135313138391605629341153", "87232486737253111567709053838971761644", "301176537118206019688446296485190556977", "227298720867210619994722286404526464743", "320580059432211571039891998163312159337", "126589234890986545332356183811704963214", "225157769788319158074990015026053240328", "217887743343146381480822658135552967292", "34586074150797236395501072178400680375", "8058249062824325069705209579206231951", "257931542921577543445064989776379055335", "319170056292468850829997776446338885613", "175102669095967882189577713037523353419", "28866816341477307423168021789210657964", "258973118936269985264340322446427215516" ] }, "id": "CURL-CVE-2024-2379-5f54d04e", "source": "https://github.com/curl/curl.git/commit/aedbbdf18e689a5eee8dc39600914f5eda6c409c", "signature_version": "v1", "signature_type": "Line", "target": { "file": "lib/vquic/vquic-tls.c" }, "deprecated": false } ] }