CVE-2024-8096 OCSP stapling bypass with GnuTLS
Attackers can bypass OCSP stapling validation in curl when using GnuTLS, allowing connections to servers with invalid certificates.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-8096?
CVE-2024-8096 is a medium-severity vulnerability in Debian Debian Linux, published on 11 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate.
Weakness: CWE-295
Which versions are affected by CVE-2024-8096?
It affects 10 products.
Linux distribution packages (13)
curl SUSE:Linux Enterprise Installer Updates 15 SP5 | All versions | 8.0.1-150400.5.50.1 |
curl SUSE:Linux Enterprise Micro 5.3 | All versions | 8.0.1-150400.5.50.1 |
curl SUSE:Linux Enterprise Micro 5.4 | All versions | 8.0.1-150400.5.50.1 |
curl SUSE:Linux Enterprise Micro 5.5 | All versions | 8.0.1-150400.5.50.1 |
curl SUSE:Linux Enterprise Module for Basesystem 15 SP5 | All versions | 8.0.1-150400.5.50.1 |
curl SUSE:Linux Enterprise Module for Basesystem 15 SP6 | All versions | 8.6.0-150600.4.6.1 |
curl SUSE:Linux Enterprise Server 12 SP5 | All versions | 8.0.1-11.92.1 |
curl SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 8.0.1-11.92.1 |
curl SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 8.0.1-11.92.1 |
curl openSUSE:Leap 15.5 | All versions | 8.0.1-150400.5.50.1 |
curl openSUSE:Leap 15.6 | All versions | 8.6.0-150600.4.6.1 |
curl openSUSE:Leap Micro 5.5 | All versions | 8.0.1-150400.5.50.1 |
curl openSUSE:Tumbleweed | All versions | 8.10.0-1.1 |
Products include Debian Debian Linux, Haxx Curl, Netapp Active Iq Unified Manager, Netapp Bootstrap Os, Netapp H300s Firmware, Netapp H410s Firmware and 4 more.
How do I fix CVE-2024-8096?
Upgrade to a fixed version.
Is CVE-2024-8096 being exploited?
There is no known exploitation of CVE-2024-8096 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2024-8096, AZL-49035, AZL-49038, AZL-49041, AZL-49099, AZL-49132 and 12 more.