CVE-2024-0853

Katalog CVE

CVSS 5.3 · Medium EPSS 1,1%

Kerentanan Improper Certificate Validation pada haxx curl. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed. A subsequent transfer to the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.

Rincian

Terbit di NVD

3 Februari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-295: Improper Certificate Validation

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 64,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://curl.se/docs/CVE-2024-0853.html advisory vendor
• https://curl.se/docs/CVE-2024-0853.json advisory vendor
• https://hackerone.com/reports/2298922 exploit · issue tracking
• https://security.netapp.com/advisory/ntap-20240307-0004/
• https://security.netapp.com/advisory/ntap-20240426-0009/
• https://security.netapp.com/advisory/ntap-20240503-0012/