OCSP stapling bypass with GnuTLS
Summary
| CVE | CVE-2024-8096 |
|---|---|
| State | PUBLISHED |
| Assigner | curl |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2024-09-11 10:15:02 UTC |
| Updated | 2026-10-15 01:19:23 UTC |
| Description | When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate. |
Risk And Classification
Primary CVSS: v3.1 6.5 MEDIUM from ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Problem Types: CWE-295 | CWE-295 Improper Certificate Validation | CWE-295 CWE-295 Improper Certificate Validation
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | ADP | DECLARED | 6.5 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
| 3.1 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary | 6.5 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
LowIntegrity
LowAvailability
NoneCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Debian | Debian Linux | 11.0 | All | All | All |
| Application | Haxx | Curl | All | All | All | All |
| Application | Netapp | Active Iq Unified Manager | - | All | All | All |
| Operating System | Netapp | Bootstrap Os | - | All | All | All |
| Hardware | Netapp | H300s | - | All | All | All |
| Operating System | Netapp | H300s Firmware | - | All | All | All |
| Hardware | Netapp | H410s | - | All | All | All |
| Operating System | Netapp | H410s Firmware | - | All | All | All |
| Hardware | Netapp | H500s | - | All | All | All |
| Operating System | Netapp | H500s Firmware | - | All | All | All |
| Hardware | Netapp | H700s | - | All | All | All |
| Operating System | Netapp | H700s Firmware | - | All | All | All |
| Hardware | Netapp | Hci Compute Node | - | All | All | All |
| Application | Netapp | Ontap Select Deploy Administration Utility | - | All | All | All |
| Application | Netapp | Ontap Tools | 10 | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Curl | Curl | affected 8.9.1 8.9.1 semver | Not specified |
| CNA | Curl | Curl | affected 8.9.0 8.9.0 semver | Not specified |
| CNA | Curl | Curl | affected 8.8.0 8.8.0 semver | Not specified |
| CNA | Curl | Curl | affected 8.7.1 8.7.1 semver | Not specified |
| CNA | Curl | Curl | affected 8.7.0 8.7.0 semver | Not specified |
| CNA | Curl | Curl | affected 8.6.0 8.6.0 semver | Not specified |
| CNA | Curl | Curl | affected 8.5.0 8.5.0 semver | Not specified |
| CNA | Curl | Curl | affected 8.4.0 8.4.0 semver | Not specified |
| CNA | Curl | Curl | affected 8.3.0 8.3.0 semver | Not specified |
| CNA | Curl | Curl | affected 8.2.1 8.2.1 semver | Not specified |
| CNA | Curl | Curl | affected 8.2.0 8.2.0 semver | Not specified |
| CNA | Curl | Curl | affected 8.1.2 8.1.2 semver | Not specified |
| CNA | Curl | Curl | affected 8.1.1 8.1.1 semver | Not specified |
| CNA | Curl | Curl | affected 8.1.0 8.1.0 semver | Not specified |
| CNA | Curl | Curl | affected 8.0.1 8.0.1 semver | Not specified |
| CNA | Curl | Curl | affected 8.0.0 8.0.0 semver | Not specified |
| CNA | Curl | Curl | affected 7.88.1 7.88.1 semver | Not specified |
| CNA | Curl | Curl | affected 7.88.0 7.88.0 semver | Not specified |
| CNA | Curl | Curl | affected 7.87.0 7.87.0 semver | Not specified |
| CNA | Curl | Curl | affected 7.86.0 7.86.0 semver | Not specified |
| CNA | Curl | Curl | affected 7.85.0 7.85.0 semver | Not specified |
| CNA | Curl | Curl | affected 7.84.0 7.84.0 semver | Not specified |
| CNA | Curl | Curl | affected 7.83.1 7.83.1 semver | Not specified |
| CNA | Curl | Curl | affected 7.83.0 7.83.0 semver | Not specified |
| CNA | Curl | Curl | affected 7.82.0 7.82.0 semver | Not specified |
| CNA | Curl | Curl | affected 7.81.0 7.81.0 semver | Not specified |
| CNA | Curl | Curl | affected 7.80.0 7.80.0 semver | Not specified |
| CNA | Curl | Curl | affected 7.79.1 7.79.1 semver | Not specified |
| CNA | Curl | Curl | affected 7.79.0 7.79.0 semver | Not specified |
| CNA | Curl | Curl | affected 7.78.0 7.78.0 semver | Not specified |
| CNA | Curl | Curl | affected 7.77.0 7.77.0 semver | Not specified |
| CNA | Curl | Curl | affected 7.76.1 7.76.1 semver | Not specified |
| CNA | Curl | Curl | affected 7.76.0 7.76.0 semver | Not specified |
| CNA | Curl | Curl | affected 7.75.0 7.75.0 semver | Not specified |
| CNA | Curl | Curl | affected 7.74.0 7.74.0 semver | Not specified |
| CNA | Curl | Curl | affected 7.73.0 7.73.0 semver | Not specified |
| CNA | Curl | Curl | affected 7.72.0 7.72.0 semver | Not specified |
| CNA | Curl | Curl | affected 7.71.1 7.71.1 semver | Not specified |
| CNA | Curl | Curl | affected 7.71.0 7.71.0 semver | Not specified |
| CNA | Curl | Curl | affected 7.70.0 7.70.0 semver | Not specified |
| CNA | Curl | Curl | affected 7.69.1 7.69.1 semver | Not specified |
| CNA | Curl | Curl | affected 7.69.0 7.69.0 semver | Not specified |
| CNA | Curl | Curl | affected 7.68.0 7.68.0 semver | Not specified |
| CNA | Curl | Curl | affected 7.67.0 7.67.0 semver | Not specified |
| CNA | Curl | Curl | affected 7.66.0 7.66.0 semver | Not specified |
| CNA | Curl | Curl | affected 7.65.3 7.65.3 semver | Not specified |
| CNA | Curl | Curl | affected 7.65.2 7.65.2 semver | Not specified |
| CNA | Curl | Curl | affected 7.65.1 7.65.1 semver | Not specified |
| CNA | Curl | Curl | affected 7.65.0 7.65.0 semver | Not specified |
| CNA | Curl | Curl | affected 7.64.1 7.64.1 semver | Not specified |
| CNA | Curl | Curl | affected 7.64.0 7.64.0 semver | Not specified |
| CNA | Curl | Curl | affected 7.63.0 7.63.0 semver | Not specified |
| CNA | Curl | Curl | affected 7.62.0 7.62.0 semver | Not specified |
| CNA | Curl | Curl | affected 7.61.1 7.61.1 semver | Not specified |
| CNA | Curl | Curl | affected 7.61.0 7.61.0 semver | Not specified |
| CNA | Curl | Curl | affected 7.60.0 7.60.0 semver | Not specified |
| CNA | Curl | Curl | affected 7.59.0 7.59.0 semver | Not specified |
| CNA | Curl | Curl | affected 7.58.0 7.58.0 semver | Not specified |
| CNA | Curl | Curl | affected 7.57.0 7.57.0 semver | Not specified |
| CNA | Curl | Curl | affected 7.56.1 7.56.1 semver | Not specified |
| CNA | Curl | Curl | affected 7.56.0 7.56.0 semver | Not specified |
| CNA | Curl | Curl | affected 7.55.1 7.55.1 semver | Not specified |
| CNA | Curl | Curl | affected 7.55.0 7.55.0 semver | Not specified |
| CNA | Curl | Curl | affected 7.54.1 7.54.1 semver | Not specified |
| CNA | Curl | Curl | affected 7.54.0 7.54.0 semver | Not specified |
| CNA | Curl | Curl | affected 7.53.1 7.53.1 semver | Not specified |
| CNA | Curl | Curl | affected 7.53.0 7.53.0 semver | Not specified |
| CNA | Curl | Curl | affected 7.52.1 7.52.1 semver | Not specified |
| CNA | Curl | Curl | affected 7.52.0 7.52.0 semver | Not specified |
| CNA | Curl | Curl | affected 7.51.0 7.51.0 semver | Not specified |
| CNA | Curl | Curl | affected 7.50.3 7.50.3 semver | Not specified |
| CNA | Curl | Curl | affected 7.50.2 7.50.2 semver | Not specified |
| CNA | Curl | Curl | affected 7.50.1 7.50.1 semver | Not specified |
| CNA | Curl | Curl | affected 7.50.0 7.50.0 semver | Not specified |
| CNA | Curl | Curl | affected 7.49.1 7.49.1 semver | Not specified |
| CNA | Curl | Curl | affected 7.49.0 7.49.0 semver | Not specified |
| CNA | Curl | Curl | affected 7.48.0 7.48.0 semver | Not specified |
| CNA | Curl | Curl | affected 7.47.1 7.47.1 semver | Not specified |
| CNA | Curl | Curl | affected 7.47.0 7.47.0 semver | Not specified |
| CNA | Curl | Curl | affected 7.46.0 7.46.0 semver | Not specified |
| CNA | Curl | Curl | affected 7.45.0 7.45.0 semver | Not specified |
| CNA | Curl | Curl | affected 7.44.0 7.44.0 semver | Not specified |
| CNA | Curl | Curl | affected 7.43.0 7.43.0 semver | Not specified |
| CNA | Curl | Curl | affected 7.42.1 7.42.1 semver | Not specified |
| CNA | Curl | Curl | affected 7.42.0 7.42.0 semver | Not specified |
| CNA | Curl | Curl | affected 7.41.0 7.41.0 semver | Not specified |
| ADP | Curl | Curl | affected 7.41.0 8.9.1 semver | Not specified |
| ADP | Siemens | RUGGEDCOM RST2428P | affected V3.3 custom | Not specified |
| ADP | Siemens | SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 Family | affected V3.3 custom | Not specified |
| ADP | Siemens | SCALANCE XCH328 | affected V3.3 custom | Not specified |
| ADP | Siemens | SCALANCE XCM324 | affected V3.3 custom | Not specified |
| ADP | Siemens | SCALANCE XCM328 | affected V3.3 custom | Not specified |
| ADP | Siemens | SCALANCE XCM332 | affected V3.3 custom | Not specified |
| ADP | Siemens | SCALANCE XRH334 24 V DC 8xFO CC | affected V3.3 custom | Not specified |
| ADP | Siemens | SCALANCE XRM334 230 V AC 12xFO | affected V3.3 custom | Not specified |
| ADP | Siemens | SCALANCE XRM334 230 V AC 8xFO | affected V3.3 custom | Not specified |
| ADP | Siemens | SCALANCE XRM334 230V AC 2x10G 24xSFP 8xSFP | affected V3.3 custom | Not specified |
| ADP | Siemens | SCALANCE XRM334 24 V DC 12xFO | affected V3.3 custom | Not specified |
| ADP | Siemens | SCALANCE XRM334 24 V DC 8xFO | affected V3.3 custom | Not specified |
| ADP | Siemens | SCALANCE XRM334 24V DC 2x10G 24xSFP 8xSFP | affected V3.3 custom | Not specified |
| ADP | Siemens | SCALANCE XRM334 2x230 V AC 12xFO | affected V3.3 custom | Not specified |
| ADP | Siemens | SCALANCE XRM334 2x230 V AC 8xFO | affected V3.3 custom | Not specified |
| ADP | Siemens | SCALANCE XRM334 2x230V AC 2x10G 24xSFP 8xSFP | affected V3.3 custom | Not specified |
| ADP | Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP | affected V3.1.0 V3.1.5 custom | Not specified |
| ADP | Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP | affected V3.1.0 V3.1.5 custom | Not specified |
| ADP | Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP | affected V3.1.0 V3.1.5 custom | Not specified |
| ADP | Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP | affected V3.1.0 V3.1.5 custom | Not specified |
| ADP | Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP | affected V3.1.0 V3.1.5 custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.openwall.com/lists/oss-security/2024/09/11/1 | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | Mailing List, Third Party Advisory |
| cert-portal.siemens.com/productcert/html/ssa-398330.html | 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e | cert-portal.siemens.com | |
| hackerone.com/reports/2669852 | 2499f714-1537-4658-8207-48ae4bb9eae9 | hackerone.com | Exploit, Issue Tracking, Third Party Advisory |
| cert-portal.siemens.com/productcert/html/ssa-089022.html | 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e | cert-portal.siemens.com | |
| security.netapp.com/advisory/ntap-20241011-0005 | af854a3a-2127-422b-91ae-364da2661108 | security.netapp.com | Third Party Advisory |
| curl.se/docs/CVE-2024-8096.html | 2499f714-1537-4658-8207-48ae4bb9eae9 | curl.se | Vendor Advisory |
| lists.debian.org/debian-lts-announce/2024/11/msg00008.html | af854a3a-2127-422b-91ae-364da2661108 | lists.debian.org | Mailing List, Third Party Advisory |
| curl.se/docs/CVE-2024-8096.json | 2499f714-1537-4658-8207-48ae4bb9eae9 | curl.se | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Hiroki Kurosawa (en)
CNA: Daniel Stenberg (en)
There are currently no legacy QID mappings associated with this CVE.