CVE-2024-2004

A flaw was found in curl. When a protocol selection parameter disables all protocols without adding any, the default set of protocols remains in the allowed set due to a logic error, allowing usage of disabled protocols.

The curl package as shipped in Red Hat Enterprise Linux 6, 7, 8, 9, and RHSCL is not affected by this vulnerability because the vulnerable code was introduced in a newer version of curl.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.