CVE-2024-0853: OCSP verification bypass with TLS session reuse
curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (OCSP stapling) test failed. A subsequent transfer to the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.
Other sources
FasterXML jackson-databind is vulnerable to a denial of service, caused by an error when using JDK serialization to serialize and deserialize JsonNode values. By sending a specially crafted request, an attacker could exploit this vulnerability to cause a denial of service.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0853?
CVE-2024-0853 has been classified with moderate severity due to potential risks in SSL session ID caching.
How do I fix CVE-2024-0853?
To fix CVE-2024-0853, update your curl to version 8.5.1 or later where the caching issue has been resolved.
What systems are affected by CVE-2024-0853?
CVE-2024-0853 affects curl version 8.5.0 that can lead to bypassing SSL verification.
Is CVE-2024-0853 a remote code execution vulnerability?
No, CVE-2024-0853 does not present a remote code execution vulnerability but poses a risk of SSL verification bypass.
What can happen if CVE-2024-0853 is exploited?
If exploited, CVE-2024-0853 may allow a successful connection to a potentially compromised server without proper SSL verification.