CVE-2024-8096 | BDVDB-2026-248016 Detail
curlcurl
Description#
When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate.
Impact#
Per CVSS v3.1: confidentiality impact low, integrity impact low, availability impact none. Attack vector: network.
Weaknesses#
- CWE-295 Improper Certificate Validation
References#
- https://curl.se/docs/CVE-2024-8096.json
- https://curl.se/docs/CVE-2024-8096.html
- https://hackerone.com/reports/2669852
- http://www.openwall.com/lists/oss-security/2024/09/11/1
- https://security.netapp.com/advisory/ntap-20241011-0005/
- https://lists.debian.org/debian-lts-announce/2024/11/msg00008.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://cert-portal.siemens.com/productcert/html/ssa-089022.html
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.