CVE-2024-2004
Fixed in a distro release EPSS 2%CVSS 3.5
When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se with a plaintext protocol which has been explicitly disabled. curl --proto -all,-http http://curl.se The flaw is only present if the set of selected protocols disables the entire set of available protocols, in itself a command with no practical use and therefore unlikely to be encountered in real situations. The curl security team has thus assessed this to be low severity bug.
Products: curl, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SINEMA Remote Connect Client, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, Siemens SINEC NMS
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.17 | curl | 8.7.1-r0 |
| Alpine 3.18 | curl | 8.7.1-r0 |
| Alpine 3.19 | curl | 8.7.1-r0 |
| Alpine 3.20 | curl | 8.7.1-r0 |
| Alpine 3.21 | curl | 8.7.1-r0 |
| Alpine 3.22 | curl | 8.7.1-r0 |
| Alpine 3.23 | curl | 8.7.1-r0 |
| Alpine 3.24 | curl | 8.7.1-r0 |
| Chainguard | curl | 8.7.1-r0 |
| Chainguard | curl-dev | 8.7.1-r0 |
| Chainguard | curl-doc | 8.7.1-r0 |
| Chainguard | curl-oci-entrypoint | 8.7.1-r0 |
| Chainguard | curl-static | 8.7.1-r0 |
| Chainguard | libcurl-openssl4 | 8.7.1-r0 |
| Chainguard | libcurl4 | 8.7.1-r0 |
| Chainguard | libcurl4 | no fix |
| Debian 12 | curl | 7.88.1-10+deb12u6 |
| Debian 13 | curl | 8.7.1-1 |
| Debian 14 | curl | 8.7.1-1 |
| Red Hat jboss core services 1 | jbcs-httpd24-curl | 0:8.7.1-2.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-curl | 0:8.7.1-2.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-curl-debuginfo | 0:8.7.1-2.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-curl-debuginfo | 0:8.7.1-2.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd | 0:2.4.57-10.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd | 0:2.4.57-10.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-debuginfo | 0:2.4.57-10.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-debuginfo | 0:2.4.57-10.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-devel | 0:2.4.57-10.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-devel | 0:2.4.57-10.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-manual | 0:2.4.57-10.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-manual | 0:2.4.57-10.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-selinux | 0:2.4.57-10.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-selinux | 0:2.4.57-10.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-tools | 0:2.4.57-10.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-tools | 0:2.4.57-10.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-tools-debuginfo | 0:2.4.57-10.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-libcurl | 0:8.7.1-2.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-libcurl | 0:8.7.1-2.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-libcurl-debuginfo | 0:8.7.1-2.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-libcurl-devel | 0:8.7.1-2.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-libcurl-devel | 0:8.7.1-2.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_http2 | 0:1.15.19-37.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_http2 | 0:1.15.19-37.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_http2-debuginfo | 0:1.15.19-37.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_http2-debuginfo | 0:1.15.19-37.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_jk | 0:1.2.49-6.redhat_1.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_jk | 0:1.2.49-6.redhat_1.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_jk-ap24 | 0:1.2.49-6.redhat_1.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_jk-ap24 | 0:1.2.49-6.redhat_1.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_jk-ap24-debuginfo | 0:1.2.49-6.redhat_1.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_jk-debuginfo | 0:1.2.49-6.redhat_1.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ldap | 0:2.4.57-10.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ldap | 0:2.4.57-10.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ldap-debuginfo | 0:2.4.57-10.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_md | 1:2.4.24-6.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_md | 1:2.4.24-6.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_md-debuginfo | 1:2.4.24-6.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_md-debuginfo | 1:2.4.24-6.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_proxy_cluster | 0:1.3.20-4.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_proxy_cluster | 0:1.3.20-4.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_proxy_cluster-debuginfo | 0:1.3.20-4.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_proxy_cluster-debuginfo | 0:1.3.20-4.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_proxy_html | 1:2.4.57-10.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_proxy_html | 1:2.4.57-10.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_proxy_html-debuginfo | 1:2.4.57-10.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_security | 0:2.9.3-36.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_security | 0:2.9.3-36.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_security-debuginfo | 0:2.9.3-36.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_security-debuginfo | 0:2.9.3-36.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_session | 0:2.4.57-10.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_session | 0:2.4.57-10.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_session-debuginfo | 0:2.4.57-10.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ssl | 1:2.4.57-10.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ssl | 1:2.4.57-10.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ssl-debuginfo | 1:2.4.57-10.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-nghttp2 | 0:1.43.0-13.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-nghttp2 | 0:1.43.0-13.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-nghttp2-debuginfo | 0:1.43.0-13.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-nghttp2-debuginfo | 0:1.43.0-13.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-nghttp2-devel | 0:1.43.0-13.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-nghttp2-devel | 0:1.43.0-13.el7jbcs |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | curl | 8.0.1-150400.5.44.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | curl | 8.0.1-150400.5.44.1 |
| SUSE Linux Enterprise Installer Updates 15 SP4 | curl | 8.0.1-150400.5.44.1 |
| SUSE Linux Enterprise Installer Updates 15 SP5 | curl | 8.0.1-150400.5.44.1 |
| SUSE Linux Enterprise Micro 5.1 | curl | 7.66.0-150200.4.69.1 |
| SUSE Linux Enterprise Micro 5.2 | curl | 7.66.0-150200.4.69.1 |
| SUSE Linux Enterprise Micro 5.3 | curl | 8.0.1-150400.5.44.1 |
| SUSE Linux Enterprise Micro 5.4 | curl | 8.0.1-150400.5.44.1 |
| SUSE Linux Enterprise Micro 5.5 | curl | 8.0.1-150400.5.44.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP5 | curl | 8.0.1-150400.5.44.1 |
| SUSE Linux Enterprise Server 12 SP5 | curl | 8.0.1-11.86.2 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | curl | 8.0.1-150400.5.44.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | curl | 8.0.1-11.86.2 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | curl | 8.0.1-150400.5.44.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP5 | curl | 8.0.1-11.86.2 |
| SUSE Linux Micro 6.0 | curl | 8.6.0-3.1 |
| SUSE Manager Proxy 4.3 | curl | 8.0.1-150400.5.44.1 |
| SUSE Manager Server 4.3 | curl | 8.0.1-150400.5.44.1 |
| Ubuntu 20.04 LTS | curl | 7.68.0-1ubuntu2.22 |
| Ubuntu 22.04 LTS | curl | 7.81.0-1ubuntu1.16 |
| Ubuntu 24.04 LTS | curl | 8.5.0-2ubuntu10.1 |
| Wolfi | curl | 8.7.1-r0 |
| Wolfi | curl-dev | 8.7.1-r0 |
| Wolfi | curl-doc | 8.7.1-r0 |
| Wolfi | curl-oci-entrypoint | 8.7.1-r0 |
| Wolfi | curl-static | 8.7.1-r0 |
| Wolfi | libcurl-openssl4 | 8.7.1-r0 |
| Wolfi | libcurl4 | no fix |
| Wolfi | libcurl4 | 8.7.1-r0 |
| openSUSE Leap 15.5 | curl | 8.0.1-150400.5.44.1 |
| openSUSE Leap Micro 5.3 | curl | 8.0.1-150400.5.44.1 |
| openSUSE Leap Micro 5.4 | curl | 8.0.1-150400.5.44.1 |
| openSUSE Tumbleweed | curl | 8.7.1-1.1 |