CVE-2024-2379
Fixed in a distro release EPSS 2%CVSS 6.3
libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.
Products: curl, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SINEMA Remote Connect Client, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, Siemens SINEC NMS
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.17 | curl | 8.7.1-r0 |
| Alpine 3.18 | curl | 8.7.1-r0 |
| Alpine 3.19 | curl | 8.7.1-r0 |
| Alpine 3.20 | curl | 8.7.1-r0 |
| Alpine 3.21 | curl | 8.7.1-r0 |
| Alpine 3.22 | curl | 8.7.1-r0 |
| Alpine 3.23 | curl | 8.7.1-r0 |
| Alpine 3.24 | curl | 8.7.1-r0 |
| Chainguard | curl | 8.7.1-r0 |
| Debian 12 | curl | no fix |
| Debian 13 | curl | 8.7.1-1 |
| Debian 14 | curl | 8.7.1-1 |
| Red Hat jboss core services 1 | jbcs-httpd24-curl | 0:8.7.1-2.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-curl | 0:8.7.1-2.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-curl-debuginfo | 0:8.7.1-2.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-curl-debuginfo | 0:8.7.1-2.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd | 0:2.4.57-10.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd | 0:2.4.57-10.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-debuginfo | 0:2.4.57-10.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-debuginfo | 0:2.4.57-10.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-devel | 0:2.4.57-10.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-devel | 0:2.4.57-10.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-manual | 0:2.4.57-10.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-manual | 0:2.4.57-10.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-selinux | 0:2.4.57-10.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-selinux | 0:2.4.57-10.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-tools | 0:2.4.57-10.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-tools | 0:2.4.57-10.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-tools-debuginfo | 0:2.4.57-10.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-libcurl | 0:8.7.1-2.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-libcurl | 0:8.7.1-2.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-libcurl-debuginfo | 0:8.7.1-2.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-libcurl-devel | 0:8.7.1-2.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-libcurl-devel | 0:8.7.1-2.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_http2 | 0:1.15.19-37.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_http2 | 0:1.15.19-37.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_http2-debuginfo | 0:1.15.19-37.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_http2-debuginfo | 0:1.15.19-37.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_jk | 0:1.2.49-6.redhat_1.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_jk | 0:1.2.49-6.redhat_1.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_jk-ap24 | 0:1.2.49-6.redhat_1.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_jk-ap24 | 0:1.2.49-6.redhat_1.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_jk-ap24-debuginfo | 0:1.2.49-6.redhat_1.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_jk-debuginfo | 0:1.2.49-6.redhat_1.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ldap | 0:2.4.57-10.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ldap | 0:2.4.57-10.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ldap-debuginfo | 0:2.4.57-10.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_md | 1:2.4.24-6.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_md | 1:2.4.24-6.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_md-debuginfo | 1:2.4.24-6.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_md-debuginfo | 1:2.4.24-6.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_proxy_cluster | 0:1.3.20-4.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_proxy_cluster | 0:1.3.20-4.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_proxy_cluster-debuginfo | 0:1.3.20-4.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_proxy_cluster-debuginfo | 0:1.3.20-4.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_proxy_html | 1:2.4.57-10.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_proxy_html | 1:2.4.57-10.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_proxy_html-debuginfo | 1:2.4.57-10.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_security | 0:2.9.3-36.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_security | 0:2.9.3-36.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_security-debuginfo | 0:2.9.3-36.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_security-debuginfo | 0:2.9.3-36.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_session | 0:2.4.57-10.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_session | 0:2.4.57-10.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_session-debuginfo | 0:2.4.57-10.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ssl | 1:2.4.57-10.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ssl | 1:2.4.57-10.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ssl-debuginfo | 1:2.4.57-10.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-nghttp2 | 0:1.43.0-13.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-nghttp2 | 0:1.43.0-13.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-nghttp2-debuginfo | 0:1.43.0-13.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-nghttp2-debuginfo | 0:1.43.0-13.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-nghttp2-devel | 0:1.43.0-13.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-nghttp2-devel | 0:1.43.0-13.el8jbcs |
| SUSE Linux Micro 6.0 | curl | 8.6.0-3.1 |
| Wolfi | curl | 8.7.1-r0 |
| openSUSE Tumbleweed | curl | 8.7.1-1.1 |