CVE-2024-2379: Apple macOS

Medium severity, CVSS 6.3. EPSS: 1.7% chance of exploitation in the next 30 days.

libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.

Affected products

• Apple macOS: before 12.7.6 (fixed in 12.7.6); from 13.0, before 13.6.8 (fixed in 13.6.8); from 14.0, before 14.6 (fixed in 14.6)
• Haxx Curl: version 8.6.0 only
• Netapp Active Iq Unified Manager: affected versions not specified
• Netapp Bootstrap OS: affected versions not specified
• Netapp h300s Firmware: affected versions not specified
• Netapp h410s Firmware: affected versions not specified
• Netapp h500s Firmware: affected versions not specified
• Netapp h610c Firmware: affected versions not specified
• Netapp h610s Firmware: affected versions not specified
• Netapp h615c Firmware: affected versions not specified
• Netapp h700s Firmware: affected versions not specified
• Netapp Ontap Select Deploy Administration Utility: affected versions not specified

Published 2024-03-27. Last modified 2026-06-17.