CVE-2024-2379: QUIC certificate check bypass with wolfSSL

Summary

CVE-2024-2379 QUIC certificate check bypass with wolfSSL

VULNERABILITY libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.

INFO To trigger, this issue also requires that the used wolfSSL library was built with the OPENSSL_COMPATIBLE_DEFAULTS symbol set, which is not set for the recommended configure --enable-curl builds.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2024-2379 to this issue. CWE-295: Improper Certificate Validation Severity: Low

Full Security Advisory: https://curl.se/docs/CVE-2024-2379.html