CVE-2024-0853

EUVD-2024-16636
curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed. A subsequent transfer to
the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CISA-ADPADP
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 36%
Affected Products (NVD)
VendorProductVersion
haxxcurl
8.5.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
curl
bookworm
7.88.1-10+deb12u14
not-affected
bookworm (security)
7.88.1-10+deb12u5
fixed
bullseye
7.74.0-1.3+deb11u13
not-affected
bullseye (security)
7.74.0-1.3+deb11u15
fixed
buster
not-affected
forky
8.18.0~rc2-1
fixed
sid
8.18.0~rc3-1
fixed
trixie
8.14.1-2+deb13u2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
curl
bionic
not-affected
focal
not-affected
jammy
not-affected
lunar
not-affected
mantic
not-affected
noble
Fixed 8.5.0-2ubuntu2
released
trusty
not-affected
xenial
not-affected
Common Weakness Enumeration
References
https://curl.se/docs/CVE-2024-0853.html
https://curl.se/docs/CVE-2024-0853.json
https://hackerone.com/reports/2298922
https://security.netapp.com/advisory/ntap-20240307-0004/
https://security.netapp.com/advisory/ntap-20240426-0009/
https://security.netapp.com/advisory/ntap-20240503-0012/
https://curl.se/docs/CVE-2024-0853.html
https://curl.se/docs/CVE-2024-0853.json
https://hackerone.com/reports/2298922
https://security.netapp.com/advisory/ntap-20240307-0004/
https://security.netapp.com/advisory/ntap-20240426-0009/
https://security.netapp.com/advisory/ntap-20240503-0012/