Bug 2270499 (CVE-2024-2379) - CVE-2024-2379 curl: QUIC certificate check bypass with wolfSSL
Summary: CVE-2024-2379 curl: QUIC certificate check bypass with wolfSSL
Keywords:
Status: NEW
Alias: CVE-2024-2379
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2270502
Blocks: 2270489
TreeView+ depends on / blocked
 
Reported: 2024-03-20 15:35 UTC by Patrick Del Bello
Modified: 2024-03-28 16:57 UTC (History)
46 users (show)

Fixed In Version: curl 8.7.0
Doc Type: ---
Doc Text:
A flaw was found in curl. When libcurl is built to use wolfSSL as the TLS backend, it skips certificate verification for a QUIC connection if an unknown/bad cipher or curve is used.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Patrick Del Bello 2024-03-20 15:35:50 UTC 
libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.

To trigger, this issue also requires that the used wolfSSL library was built with the `OPENSSL_COMPATIBLE_DEFAULTS` symbol set, which is **not** set for the recommended `configure --enable-curl` builds.

This flaw is also accessible using the curl command line tool.

Reference:
https://curl.se/docs/CVE-2024-2379.html

Upstream patch:
https://github.com/curl/curl/commit/aedbbdf18e689a5eee8dc396
Note You need to log in before you can comment on or make changes to this bug.