This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Curl fixes a medium-severity vulnerability
Curl version 8.10.0 fixes a medium-severity vulnerability [1]. Among operating systems, a fix was released for example by Debian for the sid and trixie releases in version 8.10.1-1 [2]. Ubuntu released a fix in versions 7.68.0-1ubuntu2.24, 7.81.0-1ubuntu1.18 and 8.5.0-2ubuntu10.4 [3].
An unauthenticated remote attacker can exploit a flaw in the curl implementation that incorrectly verifies the server certificate status when using the TLS Certificate Status Request extension (OCSP stapling). If OCSP returns a status other than "revoked" (for example "unauthorized"), curl incorrectly treats this status as valid, which allows the attacker to use an invalid or untrusted certificate. This issue occurs only if curl is built to use the GnuTLS library [1].
The vulnerability is present in product:
- curl; >=7.41.0, <=8.9.1
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
More information:
- CVE-2024-8096 at cve.org, NVD
- CWE-295: Improper Certificate Validation at cwe.mitre.org
The vulnerability was publicly disclosed 11. 9. 2024.
Links
By CESNET, z.s.p.o. Michaela Jarošová on 27. 9. 2024.