ALPINE-CVE-2024-2466

Advisory lineage Upstream: 1 Downstream: 0
Upstream
CVE-2024-2466
Published: 27 Mar 2024, 08:15
Last modified:08 Jul 2026, 04:31

Vulnerability Summary

Overall Risk (default)
medium
26/100
CVSS Score
6.5 MEDIUM
3.1 (osv_alpine)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

27 Mar 2024, 08:15
Published
Vulnerability first disclosed
08 Jul 2026, 04:31
Last Modified
Vulnerability information updated

Description

libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).

CVSS Metrics

  • v3.1•MEDIUM•Score: 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected Systems

  • alpine•curl

    < 8.7.1-r0 | < 8.7.1-r0 | < 8.7.1-r0 | < 8.7.1-r0 | < 8.7.1-r0 | < 8.7.1-r0 | < 8.7.1-r0 | < 8.7.1-r0 | ≥ 8.5.0, < 8.7.1-r0 | ≥ 8.5.0, < 8.7.1-r0 | ≥ 8.5.0, < 8.7.1-r0 | ≥ 8.5.0, < 8.7.1-r0 | ≥ 8.5.0, < 8.7.1-r0 | ≥ 8.5.0, < 8.7.1-r0 | ≥ 8.5.0, < 8.7.1-r0 | ≥ 8.5.0, < 8.7.1-r0

References (1)