Bug 2270499 (CVE-2024-2379) - CVE-2024-2379 curl: QUIC certificate check bypass with wolfSSL
Summary: CVE-2024-2379 curl: QUIC certificate check bypass with wolfSSL
Keywords:
Status: NEW
Alias: CVE-2024-2379
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2270502
Blocks: 2270489
TreeView+ depends on / blocked
 
Reported: 2024-03-20 15:35 UTC by Patrick Del Bello
Modified: 2024-05-07 15:47 UTC (History)
46 users (show)

Fixed In Version: curl 8.7.0
Doc Type: ---
Doc Text:
A flaw was found in curl. When libcurl is built to use wolfSSL as the TLS backend, it skips certificate verification for a QUIC connection if an unknown/bad cipher or curve is used.
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2024:2693 0 None None None 2024-05-07 15:47:45 UTC
Red Hat Product Errata RHSA-2024:2694 0 None None None 2024-05-07 15:44:49 UTC

Description Patrick Del Bello 2024-03-20 15:35:50 UTC
libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.

To trigger, this issue also requires that the used wolfSSL library was built with the `OPENSSL_COMPATIBLE_DEFAULTS` symbol set, which is **not** set for the recommended `configure --enable-curl` builds.

This flaw is also accessible using the curl command line tool.

Reference:
https://curl.se/docs/CVE-2024-2379.html

Upstream patch:
https://github.com/curl/curl/commit/aedbbdf18e689a5eee8dc396

Comment 2 errata-xmlrpc 2024-05-07 15:44:46 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Core Services

Via RHSA-2024:2694 https://access.redhat.com/errata/RHSA-2024:2694

Comment 3 errata-xmlrpc 2024-05-07 15:47:43 UTC
This issue has been addressed in the following products:

  JBoss Core Services on RHEL 7
  JBoss Core Services for RHEL 8

Via RHSA-2024:2693 https://access.redhat.com/errata/RHSA-2024:2693


Note You need to log in before you can comment on or make changes to this bug.