PT-2024-6616 · Curl+6 · Curl+6
Daniel Stenberg
+1
·
Published
2024-09-11
·
Updated
2026-05-18
·
CVE-2024-8096
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions:
curl versions prior to 8.10.0
Description:
The issue is related to the improper validation of server certificates when using the Certificate Status Request TLS extension, also known as OCSP stapling. If the returned status reports an error other than 'revoked', such as 'unauthorized', it is not treated as a bad certificate. This could potentially allow for man-in-the-middle attacks due to improper validation.
Recommendations:
For curl versions prior to 8.10.0, upgrade to version 8.10.0 or later to resolve the issue. As a temporary workaround, consider disabling the use of OCSP stapling until a patch is available. Restrict access to sensitive data and minimize the risk of exploitation by avoiding the use of vulnerable curl versions for critical operations.
Exploit
Fix
Improper Certificate Validation
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linuxmint
Red Os
Suse
Ubuntu
Curl