CVE-2024-2466
Fixed in a distro release EPSS 1%CVSS 6.5
libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).
Products: curl, libcurl, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SINEMA Remote Connect Client, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, Siemens SINEC NMS
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.17 | curl | 8.7.1-r0 |
| Alpine 3.18 | curl | 8.7.1-r0 |
| Alpine 3.19 | curl | 8.7.1-r0 |
| Alpine 3.20 | curl | 8.7.1-r0 |
| Alpine 3.21 | curl | 8.7.1-r0 |
| Alpine 3.22 | curl | 8.7.1-r0 |
| Alpine 3.23 | curl | 8.7.1-r0 |
| Alpine 3.24 | curl | 8.7.1-r0 |
| Chainguard | curl | 8.7.1-r0 |
| Debian 13 | curl | 8.7.1-1 |
| Debian 14 | curl | 8.7.1-1 |
| Red Hat jboss core services 1 | jbcs-httpd24-curl | 0:8.7.1-2.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-curl | 0:8.7.1-2.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-curl-debuginfo | 0:8.7.1-2.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-curl-debuginfo | 0:8.7.1-2.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd | 0:2.4.57-10.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd | 0:2.4.57-10.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-debuginfo | 0:2.4.57-10.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-debuginfo | 0:2.4.57-10.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-devel | 0:2.4.57-10.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-devel | 0:2.4.57-10.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-manual | 0:2.4.57-10.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-manual | 0:2.4.57-10.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-selinux | 0:2.4.57-10.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-selinux | 0:2.4.57-10.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-tools | 0:2.4.57-10.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-tools | 0:2.4.57-10.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-tools-debuginfo | 0:2.4.57-10.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-libcurl | 0:8.7.1-2.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-libcurl | 0:8.7.1-2.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-libcurl-debuginfo | 0:8.7.1-2.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-libcurl-devel | 0:8.7.1-2.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-libcurl-devel | 0:8.7.1-2.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_http2 | 0:1.15.19-37.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_http2 | 0:1.15.19-37.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_http2-debuginfo | 0:1.15.19-37.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_http2-debuginfo | 0:1.15.19-37.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_jk | 0:1.2.49-6.redhat_1.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_jk | 0:1.2.49-6.redhat_1.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_jk-ap24 | 0:1.2.49-6.redhat_1.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_jk-ap24 | 0:1.2.49-6.redhat_1.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_jk-ap24-debuginfo | 0:1.2.49-6.redhat_1.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_jk-debuginfo | 0:1.2.49-6.redhat_1.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ldap | 0:2.4.57-10.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ldap | 0:2.4.57-10.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ldap-debuginfo | 0:2.4.57-10.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_md | 1:2.4.24-6.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_md | 1:2.4.24-6.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_md-debuginfo | 1:2.4.24-6.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_md-debuginfo | 1:2.4.24-6.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_proxy_cluster | 0:1.3.20-4.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_proxy_cluster | 0:1.3.20-4.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_proxy_cluster-debuginfo | 0:1.3.20-4.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_proxy_cluster-debuginfo | 0:1.3.20-4.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_proxy_html | 1:2.4.57-10.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_proxy_html | 1:2.4.57-10.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_proxy_html-debuginfo | 1:2.4.57-10.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_security | 0:2.9.3-36.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_security | 0:2.9.3-36.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_security-debuginfo | 0:2.9.3-36.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_security-debuginfo | 0:2.9.3-36.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_session | 0:2.4.57-10.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_session | 0:2.4.57-10.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_session-debuginfo | 0:2.4.57-10.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ssl | 1:2.4.57-10.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ssl | 1:2.4.57-10.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ssl-debuginfo | 1:2.4.57-10.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-nghttp2 | 0:1.43.0-13.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-nghttp2 | 0:1.43.0-13.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-nghttp2-debuginfo | 0:1.43.0-13.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-nghttp2-debuginfo | 0:1.43.0-13.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-nghttp2-devel | 0:1.43.0-13.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-nghttp2-devel | 0:1.43.0-13.el8jbcs |
| SUSE Linux Micro 6.0 | curl | 8.6.0-3.1 |
| Wolfi | curl | 8.7.1-r0 |
| openSUSE Tumbleweed | curl | 8.7.1-1.1 |