Your submission was sent successfully! Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

CVE-2024-2466

Published: 27 March 2024

libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).

Notes

AuthorNote
mdeslaur
Ubuntu package does not use the wolfSSL backend.
affects curl 8.5.0 to and including 8.6.0
introduced in https://github.com/curl/curl/commit/fa714830e92cba7b16b9d3f

Priority

Medium

Status

Package Release Status
curl
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(code not compiled)
focal Not vulnerable
(code not compiled)
jammy Not vulnerable
(code not compiled)
mantic Not vulnerable
(code not compiled)
trusty Not vulnerable
(code not compiled)
upstream
Released (8.7.0)
xenial Not vulnerable
(code not compiled)
Patches:
upstream: https://github.com/curl/curl/commit/3d0fd382a29b95561b90b7ea3e7e