CVE-2024-8096

Katalog CVE

CVSS 6.5 · Medium EPSS 0,73%

Kerentanan Improper Certificate Validation pada haxx curl, debian linux +8 lainnya. Skor CVSS 3.1 6.5 (Medium) menurut CISA ADP.

Deskripsi (NVD)

When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate.

Rincian

Terbit di NVD

11 September 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-295: Improper Certificate Validation

EPSS (30 hari)

0,73% peluang dieksploitasi; lebih tinggi dari 53,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://curl.se/docs/CVE-2024-8096.html advisory vendor
• https://curl.se/docs/CVE-2024-8096.json advisory vendor
• https://hackerone.com/reports/2669852 exploit · issue tracking · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2024/09/11/1 mailing list · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2024/11/msg00008.html mailing list · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20241011-0005/ advisory pihak ketiga