ALPINE-CVE-2024-8096
ALPINE-CVE-2024-8096
This page contains facts from public vulnerability sources. Check the original advisory before updating.
When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate.
CVSS 6.5 · Medium · Fix available
- Published
- Updated
Stack: system
Affected products and versions
curl Alpine:v3.18
- Affected ranges
- ECOSYSTEM: ≥ 7.41.0, < 8.10.0-r0
Update to 8.10.0-r0
curl Alpine:v3.19
- Affected ranges
- ECOSYSTEM: ≥ 7.41.0, < 8.10.0-r0
Update to 8.10.0-r0
curl Alpine:v3.20
- Affected ranges
- ECOSYSTEM: ≥ 7.41.0, < 8.10.0-r0
Update to 8.10.0-r0
curl Alpine:v3.21
- Affected ranges
- ECOSYSTEM: ≥ 7.41.0, < 8.10.0-r0
Update to 8.10.0-r0
curl Alpine:v3.22
- Affected ranges
- ECOSYSTEM: ≥ 7.41.0, < 8.10.0-r0
Update to 8.10.0-r0
curl Alpine:v3.23
- Affected ranges
- ECOSYSTEM: ≥ 7.41.0, < 8.10.0-r0
Update to 8.10.0-r0
curl Alpine:v3.24
- Affected ranges
- ECOSYSTEM: ≥ 7.41.0, < 8.10.0-r0
Update to 8.10.0-r0