CVE-2024-2004

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-2004
When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se with a plaintext protocol which has been explicitly disabled. curl --proto -all,-http http://curl.se The flaw is only present if the set of selected protocols disables the entire set of available protocols, in itself a command with no practical use and therefore unlikely to be encountered in real situations. The curl security team has thus assessed this to be low severity bug.
CVSS

No CVSS.

References
Link Resource
http://seclists.org/fulldisclosure/2024/Jul/18 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2024/Jul/18 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2024/Jul/19 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2024/Jul/19 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2024/Jul/20 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2024/Jul/20 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/03/27/1 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/03/27/1 Mailing List Third Party Advisory
https://curl.se/docs/CVE-2024-2004.html Vendor Advisory
https://curl.se/docs/CVE-2024-2004.html Vendor Advisory
https://curl.se/docs/CVE-2024-2004.json Vendor Advisory
https://curl.se/docs/CVE-2024-2004.json Vendor Advisory
https://hackerone.com/reports/2384833 Exploit Issue Tracking Third Party Advisory
https://hackerone.com/reports/2384833 Exploit Issue Tracking Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6/ Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6/ Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI/ Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI/ Third Party Advisory
https://security.netapp.com/advisory/ntap-20240524-0006/ Third Party Advisory
https://security.netapp.com/advisory/ntap-20240524-0006/ Third Party Advisory
https://support.apple.com/kb/HT214118 Release Notes Vendor Advisory
https://support.apple.com/kb/HT214118 Release Notes Vendor Advisory
https://support.apple.com/kb/HT214119 Release Notes Vendor Advisory
https://support.apple.com/kb/HT214119 Release Notes Vendor Advisory
https://support.apple.com/kb/HT214120 Release Notes Vendor Advisory
https://support.apple.com/kb/HT214120 Release Notes Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:ontap:9:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*
History

30 Jul 2025, 19:42

Type Values Removed Values Added
First Time Haxx
Netapp ontap
Fedoraproject
Netapp ontap Select Deploy Administration Utility
Apple
Apple macos
Fedoraproject fedora
Netapp h300s
Netapp h500s
Netapp h500s Firmware
Netapp h700s
Netapp bootstrap Os
Netapp h410s Firmware
Netapp h700s Firmware
Netapp h300s Firmware
Haxx curl
Netapp
Netapp h410s
Netapp hci Compute Node
References () https://support.apple.com/kb/HT214120 - () https://support.apple.com/kb/HT214120 - Release Notes, Vendor Advisory
References () https://support.apple.com/kb/HT214119 - () https://support.apple.com/kb/HT214119 - Release Notes, Vendor Advisory
References () https://curl.se/docs/CVE-2024-2004.json - () https://curl.se/docs/CVE-2024-2004.json - Vendor Advisory
References () https://security.netapp.com/advisory/ntap-20240524-0006/ - () https://security.netapp.com/advisory/ntap-20240524-0006/ - Third Party Advisory
References () http://seclists.org/fulldisclosure/2024/Jul/18 - () http://seclists.org/fulldisclosure/2024/Jul/18 - Mailing List, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2024/03/27/1 - () http://www.openwall.com/lists/oss-security/2024/03/27/1 - Mailing List, Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI/ - Third Party Advisory
References () http://seclists.org/fulldisclosure/2024/Jul/19 - () http://seclists.org/fulldisclosure/2024/Jul/19 - Mailing List, Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6/ - Third Party Advisory
References () https://hackerone.com/reports/2384833 - () https://hackerone.com/reports/2384833 - Exploit, Issue Tracking, Third Party Advisory
References () https://curl.se/docs/CVE-2024-2004.html - () https://curl.se/docs/CVE-2024-2004.html - Vendor Advisory
References () https://support.apple.com/kb/HT214118 - () https://support.apple.com/kb/HT214118 - Release Notes, Vendor Advisory
References () http://seclists.org/fulldisclosure/2024/Jul/20 - () http://seclists.org/fulldisclosure/2024/Jul/20 - Mailing List, Third Party Advisory
CPE cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*
cpe:2.3:a:netapp:ontap:9:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*

30 Jul 2024, 02:15

Type Values Removed Values Added
References
  • () http://seclists.org/fulldisclosure/2024/Jul/18 -
  • () http://seclists.org/fulldisclosure/2024/Jul/19 -
  • () http://seclists.org/fulldisclosure/2024/Jul/20 -

29 Jul 2024, 22:15

Type Values Removed Values Added
References
  • () https://support.apple.com/kb/HT214120 -
  • () https://support.apple.com/kb/HT214119 -
  • () https://support.apple.com/kb/HT214118 -

10 Jun 2024, 17:16

Type Values Removed Values Added
References
  • () https://security.netapp.com/advisory/ntap-20240524-0006/ -

01 May 2024, 17:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/03/27/1 -

25 Apr 2024, 06:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6/ -

19 Apr 2024, 23:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI/ -

27 Mar 2024, 08:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-03-27 08:15

Updated : 2025-07-30 19:42

NVD link : CVE-2024-2004

Mitre link : CVE-2024-2004

JSON object : View

Products Affected

netapp

  • h410s
  • h500s
  • bootstrap_os
  • h300s
  • h410s_firmware
  • h500s_firmware
  • h700s_firmware
  • h700s
  • ontap_select_deploy_administration_utility
  • ontap
  • h300s_firmware
  • hci_compute_node

fedoraproject

  • fedora

haxx

  • curl

apple

  • macos
CWE

No CWE.