curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed. A subsequent transfer to the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-curl | Mar 21, 2024 | Feb 3, 2024 | |
| Amazon_linux_2023 | amazon-linux-2023-upgrade-curlamazon-linux-2023-upgrade-curl-debuginfoamazon-linux-2023-upgrade-curl-debugsourceamazon-linux-2023-upgrade-curl-minimalamazon-linux-2023-upgrade-curl-minimal-debuginfoamazon-linux-2023-upgrade-libcurlamazon-linux-2023-upgrade-libcurl-debuginfoamazon-linux-2023-upgrade-libcurl-develamazon-linux-2023-upgrade-libcurl-minimalamazon-linux-2023-upgrade-libcurl-minimal-debuginfo | Feb 17, 2025 | Jan 31, 2024 | |
| Freebsd | freebsd-upgrade-package-curl | Feb 29, 2024 | Feb 28, 2024 | |
| Gentoo Linux | gentoo-linux-upgrade-net-misc-curl | Sep 24, 2024 | Feb 3, 2024 | |
| Ibm Aix | ibm-aix-curl_advisory5 | Jun 25, 2024 | Feb 3, 2024 | |
| Suse | — | suse-upgrade-curlsuse-upgrade-curl-zsh-completionsuse-upgrade-libcurl-develsuse-upgrade-libcurl-devel-docsuse-upgrade-libcurl-mini4suse-upgrade-libcurl4suse-upgrade-libcurl4-32bit | Oct 31, 2024 | Feb 3, 2024 |
| Ubuntu | ubuntu-upgrade-curl | Nov 19, 2024 | Feb 3, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub