CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
CVE-2024-0853: OCSP verification bypass with TLS session reuse
Description
curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed. A subsequent transfer to
the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.
Classification
CVE ID: CVE-2024-0853
Affected Products
Vendor: curl
Product: curl
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.1% (probability of being exploited)
EPSS Percentile: 43.74% (scored less or equal to compared to others)
EPSS Date: 2025-03-14 (when was this score calculated)
References
https://curl.se/docs/CVE-2024-0853.jsonhttps://curl.se/docs/CVE-2024-0853.html
https://hackerone.com/reports/2298922
https://security.netapp.com/advisory/ntap-20240307-0004/
https://security.netapp.com/advisory/ntap-20240426-0009/
https://security.netapp.com/advisory/ntap-20240503-0012/