PT-2023-8494 · Curl+2 · Curl+2

Daniel Stenberg + 2 · Publicado 2023-12-29 · Atualizado 2026-05-18 · CVE-2024-0853

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions curl (affected versions not specified)

Description The issue is related to a flaw in curl where it inadvertently keeps the SSL session ID for connections in its cache even when the verify status (OCSP stapling) test failed. This allows a subsequent transfer to the same hostname to succeed if the session ID cache is still fresh, skipping the verify status check. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Certificate Validation

Enumeração de Fraquezas

CWE-299

CWE-295

Identificadores relacionados

ALT-PU-2024-1624

ALT-PU-2024-1813

ALT-PU-2024-2266

ALT-PU-2024-4175

AZL-34061

AZL-34648

BDU:2024-01014

CLEANSTART-2026-AY18527

CLEANSTART-2026-BW46578

CLEANSTART-2026-DI23929

CLEANSTART-2026-LQ42192

CLEANSTART-2026-OF85770

CVE-2024-0853

JLSEC-2026-412

OPENSUSE-SU-2024:13637-1

ROSA-SA-2025-2567

Produtos afetados

Alt Linux

Ibm Aix

Curl

Referências · 300

• 🔥 https://hackerone.com/reports/2298922 · Exploit
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-BW46578.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-OF85770.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-LQ42192.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-AY18527.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-DI23929.json · Nota
• https://osv.dev/vulnerability/CVE-2024-6197 · Nota
• https://twitter.com/h1Disclosed/status/1752693354981462406 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-38039 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-28321 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-1000301 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2022-27779 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2024-0853 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2024-7264 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-5436 · Nota