what is the schedule for patching: CVE-2024-2398

Question

what is the schedule for patching: CVE-2024-2398

Malik 25

Hi, we would like to know. what is the schedule or ETA patching: CVE-2024-2398

Gustavo R. Bergamini 0 Reputation points

2024-05-22T11:05:17.2433333+00:00

Some months ago, Microsoft fix cURL into a Cumulative Update and advertised to doesn´t apply any fix outside the Update provided by Microsoft.

1 answer

Your answer

Gustavo R. Bergamini 0 Reputation points

2024-05-22T11:05:17.2433333+00:00

Some months ago, Microsoft fix cURL into a Cumulative Update and advertised to doesn´t apply any fix outside the Update provided by Microsoft.

Answer 1

Wesley Li 11,285

Hello

The vulnerability identified as CVE-2024-2398 is related to the curl project and is specifically about a memory leak issue with HTTP/2 push headers. This issue was reported to the curl project on March 5, 2024.

The recommended solutions for this vulnerability are:

Upgrade curl to version 8.7.0

Apply the patch to your local version

Make sure HTTP/2 push is not used

The curl project released version 8.7.0, which includes the fix for this vulnerability, on March 27, 2024. Therefore, if you’re using a version of curl between 7.44.0 and 8.6.0, it’s recommended to upgrade to version 8.7.0 or later.

Mark 15 Reputation points

2024-05-16T02:07:33.6766667+00:00

That didn't answer the question of WHEN Microsoft intends to fix curl. The curl files are located in the System32 and SysWOW64 folders. When will Windows patch this vulnerability?
Berger, Frank 0 Reputation points

2024-05-16T14:01:58.77+00:00

MS 8.4 curl is not http2 enabled, so this CVE should not be applicable

Share via

what is the schedule for patching: CVE-2024-2398

1 answer

Your answer