Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.3

cURL on Debian 12 can be tricked to run code

CVE-2024-2379 · published 1 day ago
Summary

The cURL utility included in Debian 12 can be fooled into executing unwanted commands when processing specially crafted data. This could let an attacker run code on your system, potentially compromising data or services. Update cURL to the latest version provided by Debian to close the issue.

What to do
  • Update debian rootio-curl to version 7.88.1-10+deb12u14.root.io.12.
  • Update debian rootio-curl to version 7.88.1-10+deb12u14.root.io.7.
  • Update debian rootio-curl to version 7.88.1-10+deb12u14.root.io.10.
  • Update debian rootio-curl to version 7.88.1-10+deb12u15.aikido.13.
  • Update debian curl to version 8.7.1-1.
  • Update curl to version 7.88.1-10+deb12u15.aikido.16.
  • Update rootio-curl to version 7.88.1-10+deb12u15.aikido.16.
  • Update curl to version 7.88.1-10+deb12u15.aikido.17.
  • Update rootio-curl to version 7.88.1-10+deb12u15.aikido.17.
  • Update curl to version 7.88.1-10+deb12u15.aikido.18.
  • Update rootio-curl to version 7.88.1-10+deb12u15.aikido.18.
  • Update curl to version 7.88.1-10+deb12u15.aikido.19.
  • Update rootio-curl to version 7.88.1-10+deb12u15.aikido.19.
Affected software
Ecosystem VendorProductAffected versions
Root:Debian:12 debian rootio-curl < 7.88.1-10+deb12u14.root.io.12
< 7.88.1-10+deb12u14.root.io.7
< 7.88.1-10+deb12u14.root.io.10
< 7.88.1-10+deb12u15.aikido.13
Fix: upgrade to 7.88.1-10+deb12u14.root.io.12
Debian:12 debian curl All versions
Debian:13 debian curl < 8.7.1-1
Fix: upgrade to 8.7.1-1
Root:Debian:12 – curl < 7.88.1-10+deb12u15.aikido.16
< 7.88.1-10+deb12u15.aikido.17
< 7.88.1-10+deb12u15.aikido.18
< 7.88.1-10+deb12u15.aikido.19
Fix: upgrade to 7.88.1-10+deb12u15.aikido.16
Root:Debian:12 – rootio-curl < 7.88.1-10+deb12u15.aikido.16
< 7.88.1-10+deb12u15.aikido.17
< 7.88.1-10+deb12u15.aikido.18
< 7.88.1-10+deb12u15.aikido.19
Fix: upgrade to 7.88.1-10+deb12u15.aikido.16
– haxx curl 8.6.0
cpe:2.3:a:haxx:curl:8.6.0:*:*:*:*:*:*:*
– apple macos < 12.7.6
>= 13.0, < 13.6.8
>= 14.0, < 14.6
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
– netapp active_iq_unified_manager All versions
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
– netapp ontap_select_deploy_administration_utility All versions
cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
– netapp h300s_firmware All versions
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
– netapp h410s_firmware All versions
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
– netapp h500s_firmware All versions
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
– netapp h610c_firmware All versions
cpe:2.3:o:netapp:h610c_firmware:-:*:*:*:*:*:*:*
– netapp h610s_firmware All versions
cpe:2.3:o:netapp:h610s_firmware:-:*:*:*:*:*:*:*
– netapp h615c_firmware All versions
cpe:2.3:o:netapp:h615c_firmware:-:*:*:*:*:*:*:*
– netapp h700s_firmware All versions
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
– netapp bootstrap_os All versions
cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*
Original advisory text
CVE-2024-2379 in curl - Patched by Root
Root has patched CVE-2024-2379 in the curl package for Root:Debian:12. Multiple fixed versions available.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.3 Medium
Exploitation
2% chance of attack within 30 days
Type
CWE-295Improper Certificate Validation
Timeline
Published3 Nov 2026
Updated4 Nov 2026
First seen25 Apr 2026
Sources
CURL-CVE-2024-2379 · OSV
CVE-2024-2379 · NVD
ROOT-OS-DEBIAN-12-CVE-2024-2379 · OSV
DEBIAN-CVE-2024-2379 · OSV
CVE-2024-2379 · OSV
Track software like this
Free during beta