Docs Overview
Project
Bug Bounty Bug Report Code of conduct Dependencies Donate FAQ Features Governance History Install Known Bugs Logo TODO website Info
Protocols
CA Extract HTTP cookies HTTP/3 MQTT SSL certs SSL libs compared URL syntax WebSocket
Releases
Changelog curl CVEs Release Table Version Numbering Vulnerabilities
Tool
Comparison Table curl man page HTTP Scripting mk-ca-bundle Tutorial When options were added
Who and Why
Companies Copyright Sponsors Thanks The name
curl / Docs / curl CVEs / TLS certificate check bypass with mbedTLS
Related:
Audits
Bug Bounty
Changelog
curl CVEs
JSON metadata
Original report
Vulnerability Disclosure
Vulnerabilities Table
Awarded 2540 USD

CVE-2024-2466

TLS certificate check bypass with mbedTLS

Project curl Security Advisory, March 27th 2024 - Permalink

VULNERABILITY

libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS.

libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).

INFO

Since the SNI field is not set when using a hostname set as an IP address, many requests fail to communicate with the correct endpoint or get the correct data. Somewhat lessening the possible impact.

Not all versions of mbedTLS supports server certificate checks for IP addresses, so when this issue is fixed all attempts to connect directly to an IP address over TLS might fail.

This vulnerability is similar to a past curl vulnerability identified as CVE-2016-3739.

This flaw also affects the curl command line tool.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2024-2466 to this issue.

CWE-297: Improper Validation of Certificate with Host Mismatch

Severity: Medium

AFFECTED VERSIONS

This flaw is relevant for curl and libcurl built to use mbedTLS.

libcurl is used by many applications, but not always advertised as such!

SOLUTION

RECOMMENDATIONS

We suggest you take one of the following actions immediately, in order of preference:

A - Upgrade curl and libcurl to version 8.7.0

B - Apply the patch to your version and rebuild

C - Build your libcurl with another TLS backend

TIMELINE

This issue was reported to the curl project on March 14, 2024. We contacted distros@openwall on March 19, 2024.

curl 8.7.0 was released on March 27 2024 around 07:00 UTC, coordinated with the publication of this advisory.

CREDITS

Thanks a lot!