Curl
Curl Security Releases - March 2024
curl-2024-03 Mar 1, 2024 Source: Vendor
Curl security advisories for March 2024, compiled from CVE.org records.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.cve.org/CVERecord?id=CVE-2024-2004
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
4 lines
Showing 1–4 of 4
CVE-2024-2004
BR2024-0000-031824
curl
unclaimed
When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing prot...
Credited as Dan Fandrich
CVE-2024-2379
BR2024-0000-031825
curl
unclaimed
libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skip...
Credited as Dexter Gerig
CVE-2024-2398
BR2024-0000-031826
curl
unclaimed
When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. W...
Credited as w0x42 on hackerone
CVE-2024-2466
BR2024-0000-031827
curl
unclaimed
libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function wh...
Credited as Frank Yueh