Buy commercial curl support from
WolfSSL. We help you work out your issues, debug your libcurl
applications, use the API, port to new platforms, add new features and more.
With a team lead by the curl founder himself.
[SECURITY ADVISORY] curl: CVE-2024-2466: TLS certificate check bypass with mbedTLS
- Contemporary messages sorted: [ by date ] [ by thread ] [ by subject ] [ by author ] [ by messages with attachments ]
From: Daniel Stenberg via curl-users <curl-users_at_lists.haxx.se>
Date: Wed, 27 Mar 2024 07:58:12 +0100 (CET)
TLS certificate check bypass with mbedTLS
=========================================
Project curl Security Advisory, March 27th 2024 -
[Permalink](https://curl.se/docs/CVE-2024-2466.html)
VULNERABILITY
-------------
libcurl did not check the server certificate of TLS connections done to a host
specified as an IP address, when built to use mbedTLS.
libcurl would wrongly avoid using the set hostname function when the specified
hostname was given as an IP address, therefore completely skipping the
certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS,
POPS3, SMTPS, etc).
INFO
Date: Wed, 27 Mar 2024 07:58:12 +0100 (CET)
TLS certificate check bypass with mbedTLS
=========================================
Project curl Security Advisory, March 27th 2024 -
[Permalink](https://curl.se/docs/CVE-2024-2466.html)
VULNERABILITY
-------------
libcurl did not check the server certificate of TLS connections done to a host
specified as an IP address, when built to use mbedTLS.
libcurl would wrongly avoid using the set hostname function when the specified
hostname was given as an IP address, therefore completely skipping the
certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS,
POPS3, SMTPS, etc).
INFO
---- Since the SNI field is not set when using a hostname set as an IP address, many requests will fail to communicate with the correct endpoint or get the correct data. Somewhat lessening the possible impact. Not all versions of mbedTLS supports server certificate checks for IP addresses, so when this issue is fixed all attempts to connect directly to an IP address over TLS might fail. This vulnerability is similar to a past curl vulnerability identified as CVE-2016-3739. This flaw also affects the curl command line tool. The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2024-2466 to this issue. CWE-297: Improper Validation of Certificate with Host Mismatch Severity: Medium AFFECTED VERSIONS ----------------- This flaw is relevant for curl and libcurl built to use mbedTLS. - Affected versions: curl 8.5.0 to and including 8.6.0 - Not affected versions: curl < 8.5.0 and >= 8.7.0 - Introduced-in: https://github.com/curl/curl/commit/fa714830e92cba7b16b9d3f libcurl is used by many applications, but not always advertised as such! SOLUTION ------------ - Fixed-in: https://github.com/curl/curl/commit/3d0fd382a29b95561b90b7ea3e7e RECOMMENDATIONS --------------- We suggest you take one of the following actions immediately, in order of preference: A - Upgrade curl and libcurl to version 8.7.0 B - Apply the patch to your version and rebuild C - Build your libcurl with another TLS backend TIMELINE --------- This issue was reported to the curl project on March 14, 2024. We contacted distros_at_openwall on March 19, 2024. curl 8.7.0 was released on March 27 2024 around 07:00 UTC, coordinated with the publication of this advisory. CREDITS ------- - Reported-by: Frank Yueh - Patched-by: Stefan Eissing Thanks a lot! -- / daniel.haxx.se -- Unsubscribe: https://lists.haxx.se/mailman/listinfo/curl-users Etiquette: https://curl.se/mail/etiquette.htmlReceived on 2024-03-27