CVE-2024-0853 OCSP verification bypass with TLS session reuse
Attackers can bypass OCSP stapling verification by reusing cached TLS sessions, allowing connections to servers with revoked certificates.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-0853?
CVE-2024-0853 is a medium-severity vulnerability in Haxx Curl, published on 3 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed. A subsequent transfer to the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.
Weakness: CWE-295
Which versions are affected by CVE-2024-0853?
It affects 1 product.
Linux distribution packages (1)
curl openSUSE:Tumbleweed | All versions | 8.6.0-1.1 |
Products include Haxx Curl.
How do I fix CVE-2024-0853?
Apply the vendor's patch.
Is CVE-2024-0853 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-0853 exists.
Other vulnerabilities in Haxx Curl
Sources
Also known as ALPINE-CVE-2024-0853, AZL-34061, AZL-34648, BELL-CVE-2024-0853, CLEANSTART-2026-JD03338, CURL-CVE-2024-0853 and 5 more.