[{"vendor":"curl","product":"libcurl","defaultStatus":"unaffected","cpes":["cpe:2.3:a:curl:libcurl:8.5.0:*:*:*:*:*:*:*"],"versions":[{"version":"8.5.0","lessThanOrEqual":"8.6.0","versionType":"custom","status":"affected"}]}]

{"timestamp":"2024-08-23T18:43:18.887717Z","id":"CVE-2024-2466","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"curl","product":"curl","defaultStatus":"unaffected","versions":[{"version":"8.6.0","lessThanOrEqual":"8.6.0","versionType":"semver","status":"affected"},{"version":"8.5.0","lessThanOrEqual":"8.5.0","versionType":"semver","status":"affected"}]}]

AND
     OR
          *cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*
     OR
          cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*

AND
     OR
          *cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
     OR
          cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

AND
     OR
          *cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
     OR
          cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*

AND
     OR
          *cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
     OR
          cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*

AND
     OR
          *cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
     OR
          cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*

OR
          *cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* versions from (including) 8.5.0 up to (excluding) 8.7.0

OR
          *cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* versions up to (excluding) 12.7.6
          *cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* versions from (including) 14.0 up to (excluding) 14.6
          *cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* versions from (including) 13.0 up to (excluding) 13.6.8

CVE: http://seclists.org/fulldisclosure/2024/Jul/18 Types: Mailing List, Third Party Advisory

CVE: http://seclists.org/fulldisclosure/2024/Jul/19 Types: Mailing List, Third Party Advisory

CVE: http://seclists.org/fulldisclosure/2024/Jul/20 Types: Mailing List, Third Party Advisory

CVE: http://www.openwall.com/lists/oss-security/2024/03/27/4 Types: Mailing List, Third Party Advisory

CVE: https://curl.se/docs/CVE-2024-2466.html Types: Vendor Advisory

CVE: https://curl.se/docs/CVE-2024-2466.json Types: Vendor Advisory

CVE: https://hackerone.com/reports/2416725 Types: Exploit, Issue Tracking, Third Party Advisory

CVE: https://security.netapp.com/advisory/ntap-20240503-0010/ Types: Third Party Advisory

CVE: https://support.apple.com/kb/HT214118 Types: Release Notes, Vendor Advisory

CVE: https://support.apple.com/kb/HT214119 Types: Release Notes, Vendor Advisory

CVE: https://support.apple.com/kb/HT214120 Types: Release Notes, Vendor Advisory

CVE: https://www.vicarius.io/vsociety/posts/tls-certificate-check-bypass-curl-with-mbedtls-cve-2024-2466-2468 Types: Exploit, Mitigation, Third Party Advisory

curl: http://seclists.org/fulldisclosure/2024/Jul/18 Types: Mailing List, Third Party Advisory

curl: http://seclists.org/fulldisclosure/2024/Jul/19 Types: Mailing List, Third Party Advisory

curl: http://seclists.org/fulldisclosure/2024/Jul/20 Types: Mailing List, Third Party Advisory

curl: http://www.openwall.com/lists/oss-security/2024/03/27/4 Types: Mailing List, Third Party Advisory

curl: https://curl.se/docs/CVE-2024-2466.html Types: Vendor Advisory

curl: https://curl.se/docs/CVE-2024-2466.json Types: Vendor Advisory

curl: https://hackerone.com/reports/2416725 Types: Exploit, Issue Tracking, Third Party Advisory

curl: https://security.netapp.com/advisory/ntap-20240503-0010/ Types: Third Party Advisory

curl: https://support.apple.com/kb/HT214118 Types: Release Notes, Vendor Advisory

curl: https://support.apple.com/kb/HT214119 Types: Release Notes, Vendor Advisory

curl: https://support.apple.com/kb/HT214120 Types: Release Notes, Vendor Advisory

http://seclists.org/fulldisclosure/2024/Jul/18

http://seclists.org/fulldisclosure/2024/Jul/19

http://seclists.org/fulldisclosure/2024/Jul/20

http://www.openwall.com/lists/oss-security/2024/03/27/4

https://curl.se/docs/CVE-2024-2466.html

https://curl.se/docs/CVE-2024-2466.json

https://hackerone.com/reports/2416725

https://security.netapp.com/advisory/ntap-20240503-0010/

https://support.apple.com/kb/HT214118

https://support.apple.com/kb/HT214119

https://support.apple.com/kb/HT214120

https://www.vicarius.io/vsociety/posts/tls-certificate-check-bypass-curl-with-mbedtls-cve-2024-2466-2468

CISA-ADP AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CISA-ADP CWE-297

curl http://seclists.org/fulldisclosure/2024/Jul/18 [No types assigned]

curl http://seclists.org/fulldisclosure/2024/Jul/19 [No types assigned]

curl http://seclists.org/fulldisclosure/2024/Jul/20 [No types assigned]

curl https://support.apple.com/kb/HT214118 [No types assigned]

curl https://support.apple.com/kb/HT214119 [No types assigned]

curl https://support.apple.com/kb/HT214120 [No types assigned]

curl https://security.netapp.com/advisory/ntap-20240503-0010/ [No types assigned]

curl http://www.openwall.com/lists/oss-security/2024/03/27/4 [No types assigned]

libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS.  libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).

curl https://curl.se/docs/CVE-2024-2466.html [No types assigned]

curl https://curl.se/docs/CVE-2024-2466.json [No types assigned]

curl https://hackerone.com/reports/2416725 [No types assigned]