CVE-2024-0853

curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed. A subsequent transfer to
the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
curlCNA
---
---
CVEADP
---
---
CISA-ADPADP
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 36%
VendorProductVersion
haxxcurl
8.5.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
curl
bullseye
7.74.0-1.3+deb11u13
not-affected
bookworm
7.88.1-10+deb12u14
not-affected
buster
not-affected
bullseye (security)
7.74.0-1.3+deb11u15
fixed
bookworm (security)
7.88.1-10+deb12u5
fixed
trixie
8.14.1-2+deb13u2
fixed
forky
8.17.0-3
fixed
sid
8.17.0-3
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
curl
noble
Fixed 8.5.0-2ubuntu2
released
mantic
not-affected
lunar
not-affected
jammy
not-affected
focal
not-affected
bionic
not-affected
xenial
not-affected
trusty
not-affected
Common Weakness Enumeration
References
https://curl.se/docs/CVE-2024-0853.html
https://curl.se/docs/CVE-2024-0853.json
https://hackerone.com/reports/2298922
https://security.netapp.com/advisory/ntap-20240307-0004/
https://security.netapp.com/advisory/ntap-20240426-0009/
https://security.netapp.com/advisory/ntap-20240503-0012/
https://curl.se/docs/CVE-2024-0853.html
https://curl.se/docs/CVE-2024-0853.json
https://hackerone.com/reports/2298922
https://security.netapp.com/advisory/ntap-20240307-0004/
https://security.netapp.com/advisory/ntap-20240426-0009/
https://security.netapp.com/advisory/ntap-20240503-0012/