CVE-2024-2004: curl from 7.85.0 (inclusive), before 8.7.0 (exclusive), 8.6.0 through 8.6.0, 8.5.0 through 8.5.0, 8.4.0 through 8.4.0…

Affected technology

curl · from 7.85.0 (inclusive), before 8.7.0 (exclusive)
haxx

fedora · 39
fedoraproject

fedora · 40
fedoraproject

macos · before 12.7.6 (exclusive)
apple

macos · from 13.0 (inclusive), before 13.6.8 (exclusive)
apple

macos · from 14.0 (inclusive), before 14.6 (exclusive)
apple

ontap · 9
netapp

ontap select deploy administration utility · Version not applicable in the source CPE
netapp

bootstrap os · Version not applicable in the source CPE
netapp

h300s firmware · Version not applicable in the source CPE
netapp

h410s firmware · Version not applicable in the source CPE
netapp

h500s firmware · Version not applicable in the source CPE
netapp

h700s firmware · Version not applicable in the source CPE
netapp

curl · 8.6.0 through 8.6.0, 8.5.0 through 8.5.0, 8.4.0 through 8.4.0, 8.3.0 through 8.3.0, 8.2.1 through 8.2.1, 8.2.0 through 8.2.0, 8.1.2 through 8.1.2, 8.1.1 through 8.1.1, 8.1.0 through 8.1.0, 8.0.1 through 8.0.1, 8.0.0 through 8.0.0, 7.88.1 through 7.88.1, 7.88.0 through 7.88.0, 7.87.0 through 7.87.0, 7.86.0 through 7.86.0, 7.85.0 through 7.85.0
curl

SIMATIC S7-1500 CPU 1518-4 PN/DP MFP · V3.1.0 to before V3.1.5
Siemens

SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP · V3.1.0 to before V3.1.5
Siemens

SINEMA Remote Connect Client · 0 to before V3.2 SP2
Siemens

SIPLUS S7-1500 CPU 1518-4 PN/DP MFP · V3.1.0 to before V3.1.5
Siemens

SINEC NMS · 0 to before V3.0 SP1
Siemens

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · Low privileges required · User interaction required

What an attacker can do

Source advisory’s CVSS 3.1 assessment (base score 3.5/10) rates confidentiality impact as low; integrity and availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.