When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate.
History

Fri, 11 Oct 2024 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Curl
Curl curl
CPEs cpe:2.3:a:curl:curl:*:*:*:*:*:*:*:*
Vendors & Products Curl
Curl curl
References
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Wed, 11 Sep 2024 14:30:00 +0000

Type Values Removed Values Added
References

Wed, 11 Sep 2024 13:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-295
References
Metrics threat_severity

None

cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}

threat_severity

Moderate


Wed, 11 Sep 2024 10:15:00 +0000

Type Values Removed Values Added
Description When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate.
Title OCSP stapling bypass with GnuTLS
References

cve-icon MITRE

Status: PUBLISHED

Assigner: curl

Published: 2024-09-11T10:03:59.489Z

Updated: 2024-11-14T17:02:37.437Z

Reserved: 2024-08-22T14:46:26.822Z

Link: CVE-2024-8096

cve-icon Vulnrichment

Updated: 2024-11-14T17:02:37.437Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2024-09-11T10:15:02.883

Modified: 2024-09-11T16:26:11.920

Link: CVE-2024-8096

cve-icon Redhat

Severity : Moderate

Publid Date: 2024-09-11T00:00:00Z

Links: CVE-2024-8096 - Bugzilla