CVE-2024-2004: haxx curl +9 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2024-2004

CVSS 3.5 · Low EPSS 1,7%

Kerentanan Interpretation Conflict pada haxx curl, fedoraproject fedora +8 lainnya. Skor CVSS 3.1 3.5 (Low) menurut CISA ADP.

Deskripsi (NVD)

When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se with a plaintext protocol which has been explicitly disabled. curl --proto -all,-http http://curl.se The flaw is only present if the set of selected protocols disables the entire set of available protocols, in itself a command with no practical use and therefore unlikely to be encountered in real situations. The curl security team has thus assessed this to be low severity bug.

Rincian

Terbit di NVD: 27 Maret 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 3.5 (Low), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-436: Interpretation Conflict
EPSS (30 hari): 1,7% peluang dieksploitasi; lebih tinggi dari 76,3% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
haxx	curl	Versi 7.85.0 hingga sebelum 8.7.0
fedoraproject	fedora	Versi 39
fedoraproject	fedora	Versi 40
apple	macos	Semua versi sebelum 12.7.6
apple	macos	Versi 13.0 hingga sebelum 13.6.8
apple	macos	Versi 14.0 hingga sebelum 14.6
netapp	ontap	Versi 9
netapp	ontap select deploy administration utility	Semua versi
netapp	bootstrap os	Semua versi
netapp	h300s firmware	Semua versi
netapp	h410s firmware	Semua versi
netapp	h500s firmware	Semua versi
netapp	h700s firmware	Semua versi

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://curl.se/docs/CVE-2024-2004.html advisory vendor
https://curl.se/docs/CVE-2024-2004.json advisory vendor
https://support.apple.com/kb/HT214118 release notes · advisory vendor
https://support.apple.com/kb/HT214119 release notes · advisory vendor
https://support.apple.com/kb/HT214120 release notes · advisory vendor
http://seclists.org/fulldisclosure/2024/Jul/18 mailing list · advisory pihak ketiga
http://seclists.org/fulldisclosure/2024/Jul/19 mailing list · advisory pihak ketiga
http://seclists.org/fulldisclosure/2024/Jul/20 mailing list · advisory pihak ketiga
http://www.openwall.com/lists/oss-security/2024/03/27/1 mailing list · advisory pihak ketiga
https://hackerone.com/reports/2384833 exploit · issue tracking · advisory pihak ketiga
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D44YLAUFJU6BZ4... advisory pihak ketiga
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GMD6UYKCCRCYETW... advisory pihak ketiga
https://security.netapp.com/advisory/ntap-20240524-0006/ advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.