ALPINE-CVE-2024-2379 — Vulnetix

Try Vulnetix Request Demo

ALPINE-CVE-2024-2379 PUBLISHED CVSS 6.300000190734863 MEDIUM

libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.

Risk Scores

CVSS v3.1

6.300000190734863

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Affected Products

Vendor	Product	Versions
Alpine:v3.19	curl	7.26.0-r0, 7.21.7-r2, 7.21.7-r1
Alpine:v3.17	curl	7.19.2-r0, 7.19.2-r1, 7.19.4-r0
Alpine:v3.21	curl	7.53.0-r0, 0, 7.19.2-r0
Alpine:v3.20	curl	7.52.1-r1, 7.53.0-r0, 7.53.1-r0
Alpine:v3.23	curl	8.3.0-r0, 7.19.2-r0, 7.19.4-r0
Alpine:v3.18	curl	7.21.4-r1, 0, 8.5.0-r0
Alpine:v3.22	curl	7.76.0-r0, 7.30.0-r0, 7.29.0-r0

Timeline

Mar 27, 2024 CVE Published
Dec 3, 2025 CVE Updated
Apr 30, 2026 Distribution Patch

References

https://security.alpinelinux.org/vuln/CVE-2024-2379 advisory

Open in Interactive Console →