CVE-2024-0853: OCSP verification bypass with TLS session reuse

Summary

CVE-2024-0853 - OCSP verification bypass with TLS session reuse

VULNERABILITY curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (OCSP stapling) test failed. A subsequent transfer to the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.

INFO This issue is limited to curl built to use OpenSSL and when using TLS 1.2 only and not TLS 1.3.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2024-0853 to this issue.

CWE-299: Improper Check for Certificate Revocation Severity: Low

AFFECTED VERSIONS Affected versions: curl 8.5.0 to and including 8.5.0 Not affected versions: curl < 8.5.0 and >= 8.6.0 Introduced-in: https: //github.com/curl/curl/commit/395365ad2d9a6c3f1a35d libcurl is used by many applications, but not always advertised as such!

This flaw is also accessible using the curl command line tool.

SOLUTION If verify status fails, make sure the session id is not cached. Fixed-in: https: //github.com/curl/curl/commit/c28e9478cb2548848ec

CREDITS Reported-by: Hiroki Kurosawa Patched-by: Daniel Stenberg

Full Security Advisory: https://curl.se/docs/CVE-2024-0853.html