CVE-2024-8096: OCSP stapling bypass with GnuTLS
cURL libcurl could allow a remote attacker to bypass security restrictions, caused by a flaw when using OCSP stapling to validate server cerficate. By sending a specially crafted request, an attacker could exploit this vulnerability to establish the connection even if the certificate is revoked.
Other sources
When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8096?
CVE-2024-8096 has been assigned a critical severity rating due to its potential to allow remote attackers to bypass security restrictions.
How do I fix CVE-2024-8096?
To fix CVE-2024-8096, upgrade to the recommended version of cURL, which is 8.10.0-2 or higher.
What products are affected by CVE-2024-8096?
CVE-2024-8096 affects the cURL package on Debian and the IBM QRadar WinCollect Agent up to version 10.1.12.
Can CVE-2024-8096 be exploited remotely?
Yes, CVE-2024-8096 can be exploited by a remote attacker through specially crafted requests that manipulate OCSP stapling.
What happens if I don't address CVE-2024-8096?
If CVE-2024-8096 is not addressed, the system may be vulnerable to establishing insecure connections despite invalid server certificates.