Bug 2270499 (CVE-2024-2379)

Summary: CVE-2024-2379 curl: QUIC certificate check bypass with wolfSSL
Product: [Other] Security Response Reporter: Patrick Del Bello <pdelbell>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: aarif, agarcial, aoconnor, aprice, asegurap, bdettelb, caswilli, csutherl, dfreiber, dkuc, drow, fjansen, gsuckevi, hhorak, hkataria, jburrell, jclere, jmitchel, jorton, jsamir, jsherril, jtanner, kaycoth, kdudka, kshier, luhliari, luizcosta, mpierce, nweather, orabin, pjindal, plodge, psegedy, security-response-team, sidakwo, stcannon, sthirugn, szappis, vkrizan, vkumar, vmugicag, xiaoxwan, yguenane, zzhou
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: curl 8.7.0 Doc Type: ---
Doc Text:
A flaw was found in curl. When libcurl is built to use wolfSSL as the TLS backend, it skips certificate verification for a QUIC connection if an unknown/bad cipher or curve is used.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2270502    
Bug Blocks: 2270489    

Description Patrick Del Bello 2024-03-20 15:35:50 UTC 
libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.

To trigger, this issue also requires that the used wolfSSL library was built with the `OPENSSL_COMPATIBLE_DEFAULTS` symbol set, which is **not** set for the recommended `configure --enable-curl` builds.

This flaw is also accessible using the curl command line tool.

Reference:
https://curl.se/docs/CVE-2024-2379.html

Upstream patch:
https://github.com/curl/curl/commit/aedbbdf18e689a5eee8dc396
Comment 2 errata-xmlrpc 2024-05-07 15:44:46 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Core Services

Via RHSA-2024:2694 https://access.redhat.com/errata/RHSA-2024:2694
Comment 3 errata-xmlrpc 2024-05-07 15:47:43 UTC 
This issue has been addressed in the following products:

  JBoss Core Services on RHEL 7
  JBoss Core Services for RHEL 8

Via RHSA-2024:2693 https://access.redhat.com/errata/RHSA-2024:2693