Medium · published March 27, 2024
libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.
| Product | Versions | Fixed in |
|---|---|---|
| haxx/curl | all versions | — |
| apple/macos | < 12.7.6 | 12.7.6 |
| apple/macos | ≥ 13.0, < 13.6.8 | 13.6.8 |
| apple/macos | ≥ 14.0, < 14.6 | 14.6 |
| netapp/active_iq_unified_manager | all versions | — |
| netapp/ontap_select_deploy_administration_utility | all versions | — |
| netapp/h300s_firmware | all versions | — |
| netapp/h410s_firmware | all versions | — |
| netapp/h500s_firmware | all versions | — |
| netapp/h610c_firmware | all versions | — |
| netapp/h610s_firmware | all versions | — |
| netapp/h615c_firmware | all versions | — |
| netapp/h700s_firmware | all versions | — |
| netapp/bootstrap_os | all versions | — |