medium6.5
CVE-2024-8096
When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it m…
Impact
When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Haxx | Curl | from 7.41.0 before 8.10.0 |
| Debian | Debian Linux | Version 11.0 |
| Netapp | Active Iq Unified Manager | All versions |
| Netapp | Ontap Select Deploy Administration Utility | All versions |
| Netapp | Ontap Tools | Version 10 |
| Netapp | Bootstrap Os | All versions |
| Netapp | H300s Firmware | All versions |
| Netapp | H410s Firmware | All versions |
| Netapp | H500s Firmware | All versions |
| Netapp | H700s Firmware | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- https://curl.se/docs/CVE-2024-8096.html
- https://curl.se/docs/CVE-2024-8096.json
- https://hackerone.com/reports/2669852
- http://www.openwall.com/lists/oss-security/2024/09/11/1
- https://lists.debian.org/debian-lts-announce/2024/11/msg00008.html
- https://security.netapp.com/advisory/ntap-20241011-0005/
- https://cert-portal.siemens.com/productcert/html/ssa-089022.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html