CVE-2024-0853: OCSP verification bypass with TLS session reuse
curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (OCSP stapling) test failed. A subsequent transfer to the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.
Other sources
FasterXML jackson-databind is vulnerable to a denial of service, caused by an error when using JDK serialization to serialize and deserialize JsonNode values. By sending a specially crafted request, an attacker could exploit this vulnerability to cause a denial of service.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 8.6.0-1 - Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 7.88.1-10+deb12u15Fixed in 7.88.1-10+deb12u5Fixed in 8.14.1-2+deb13u5Fixed in 8.14.1-2+deb13u7Fixed in 8.22.0-1Fixed in 8.23.0-1 - Upgrade
Upgrade
alpine/curlto a version that resolves this vulnerability.Fixed in 8.6.0-r0
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0853?
CVE-2024-0853 has been classified with moderate severity due to potential risks in SSL session ID caching.
How do I fix CVE-2024-0853?
To fix CVE-2024-0853, update your curl to version 8.5.1 or later where the caching issue has been resolved.
What systems are affected by CVE-2024-0853?
CVE-2024-0853 affects curl version 8.5.0 that can lead to bypassing SSL verification.
Is CVE-2024-0853 a remote code execution vulnerability?
No, CVE-2024-0853 does not present a remote code execution vulnerability but poses a risk of SSL verification bypass.
What can happen if CVE-2024-0853 is exploited?
If exploited, CVE-2024-0853 may allow a successful connection to a potentially compromised server without proper SSL verification.