https://seclists.org/oss-sec/2024/q1/73: [SECURITY ADVISORY] curl: CVE-2024-0853 : OCSP verification bypass with TLS session reuse
Published Jan 31, 2024
·Updated
Affected Software
1 affected component
curl curl
Frequently Asked Questions
1
What is the severity of CVE-2024-0853?
CVE-2024-0853 is classified as a high-severity vulnerability due to its potential to allow unauthorized access through OCSP verification bypass.
2
How do I fix CVE-2024-0853?
To fix CVE-2024-0853, update curl to version 8.0.3 or later, where the vulnerability has been addressed.
3
What impact does CVE-2024-0853 have on user data?
CVE-2024-0853 can compromise the security of user data by allowing a malicious actor to bypass certificate validation when reusing TLS sessions.
4
Is CVE-2024-0853 specific to certain versions of curl?
CVE-2024-0853 affects curl versions prior to 8.0.3, which are vulnerable to the OCSP verification bypass.
5
What is OCSP verification and why is it important in the context of CVE-2024-0853?
OCSP verification is a mechanism used to check the revocation status of digital certificates, and CVE-2024-0853 allows its bypass, undermining trust in the TLS security model.