CVE-2024-9681: HSTS subdomain overwrites parent cache entry

Reference Links

• https://curl.se/docs/CVE-2024-9681.html
• https://github.com/curl/curl/commit/7385610d0c74c6a254fea5e4cd6e1d559d848c8c
• https://github.com/curl/curl/commit/a94973805df96269bf3f3bf0a20ccb9887313316
• https://security-tracker.debian.org/tracker/CVE-2024-9681
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-9681
• https://nvd.nist.gov/vuln/detail/CVE-2024-9681
• https://launchpad.net/bugs/cve/CVE-2024-9681
• https://ubuntu.com/security/CVE-2024-9681
• https://curl.se/docs/CVE-2024-9681.json
• https://hackerone.com/reports/2764830
• http://www.openwall.com/lists/oss-security/2024/11/06/2
• https://security.netapp.com/advisory/ntap-20241213-0006/
• https://www.ibm.com/support/pages/node/7176043 (Advisory)

Parent vulnerabilities

(Appears in the following advisories)

• IBM-7176043

Frequently Asked Questions

• What is the severity of CVE-2024-9681?

  CVE-2024-9681 is considered a moderate severity vulnerability due to its impact on HSTS caching behavior.

• How do I fix CVE-2024-9681?

  To remediate CVE-2024-9681, update curl to version 8.11.0 or later, or ensure your application does not rely on insecure HSTS settings.

• What systems are impacted by CVE-2024-9681?

  CVE-2024-9681 affects curl versions between 7.74.0 and 8.11.0, and it also impacts IBM QRadar WinCollect Agent versions up to 10.1.12.

• What is the root cause of CVE-2024-9681?

  The root cause of CVE-2024-9681 is the improper handling of HSTS cache entries for subdomains, which can affect the intended expiry time.

• How does CVE-2024-9681 affect HSTS usage?

  CVE-2024-9681 may lead to unintended consequences by allowing a subdomain's expiry time to overwrite that of its parent domain in HSTS configuration.