Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed. A subsequent transfer to the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
唐突に。どうでもいいことだが2年前公開で540USDのこのバグ https://curl.se/docs/CVE-2024-0853.html このブログ内容をcurlで呼び出した場合に該当の症状なのよね。 https://www.cybertrust.co.jp/blog/rd/pqc/pqc-ocsp.html まあcurlにはOCSP周りのバグの蓄積あるので、一度は直したけどデグレで復活だったのかもしれんが。
Post summary
The post references CVE-2024-0853, noting that curl had previously fixed an OCSP-related bug but it may have regressed, implying a patch was applied.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | haxx | curl | 8.5.0 | - | - |