What’s Vulnerable › Vulnerabilities

CVE-2024-2466: TLS certificate check bypass with mbedTLS

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-03-27 · updated 2026-10-15
• Weakness: CWE-297

Description

libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).

Affected products

• Apple macOS: before 12.7.6; from 13.0 before 13.6.8; from 14.0 before 14.6 — fixed in 12.7.6, 13.6.8, 14.6
• curl: from 8.5.0 before 8.7.0 — fixed in 8.7.0
• NetApp Bootstrap Os: all versions
• NetApp H300S Firmware: all versions
• NetApp H410S Firmware: all versions
• NetApp H500S Firmware: all versions
• NetApp H700S Firmware: all versions

How to fix

Upgrade to a fixed version: Apple macOS 12.7.6, 13.6.8, 14.6; curl 8.7.0. Check the vendor advisory for mitigations.

References

• http://seclists.org/fulldisclosure/2024/Jul/18
• http://seclists.org/fulldisclosure/2024/Jul/19
• http://seclists.org/fulldisclosure/2024/Jul/20
• http://www.openwall.com/lists/oss-security/2024/03/27/4
• https://curl.se/docs/CVE-2024-2466.html
• https://curl.se/docs/CVE-2024-2466.json
• https://hackerone.com/reports/2416725
• https://security.netapp.com/advisory/ntap-20240503-0010/
• https://support.apple.com/kb/HT214118
• https://support.apple.com/kb/HT214119
• https://support.apple.com/kb/HT214120
• http://seclists.org/fulldisclosure/2024/Jul/18

Get alerted when CVE-2024-2466 or the next vulnerability affects your stack