CVE-2024-8096

When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate.

When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate.

When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate.

When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate.

When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate.

When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate.

When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate.

When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate.

When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate.

When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine.

If the returned status reports another error than "revoked" (like for example "unauthorized") it is not treated as a bad certificate.

These are all security issues fixed in the curl-8.10.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for curl fixes the following issues:

• CVE-2024-8096: OCSP stapling bypass with GnuTLS. (bsc#1230093)
• CVE-2024-7264: ASN.1 date parser overread. (bsc#1228535)

This update for curl fixes the following issues:

• CVE-2024-8096: OCSP stapling bypass with GnuTLS. (bsc#1230093)

This update for curl fixes the following issues:

• CVE-2024-8096: OCSP stapling bypass with GnuTLS. (bsc#1230093)

This update for curl fixes the following issues:

• CVE-2024-8096: OCSP stapling bypass with GnuTLS. (bsc#1230093)

This update for curl fixes the following issues:

Update to 8.12.1:

• Bugfixes:

  • asyn-thread: fix build with 'CURL_DISABLE_SOCKETPAIR'
  • asyn-thread: fix HTTPS RR crash
  • asyn-thread: fix the returned bitmask from Curl_resolver_getsock
  • asyn-thread: survive a c-ares channel set to NULL
  • cmake: always reference OpenSSL and ZLIB via imported targets
  • cmake: respect 'GNUTLS_CFLAGS' when detected via 'pkg-config'
  • cmake: respect 'GNUTLS_LIBRARY_DIRS' in 'libcurl.pc' and 'curl-config'
  • content_encoding: #error on too old zlib
  • imap: TLS upgrade fix
  • ldap: drop support for legacy Novell LDAP SDK
  • libssh2: comparison is always true because rc <= -1
  • libssh2: raise lowest supported version to 1.2.8
  • libssh: drop support for libssh older than 0.9.0
  • openssl-quic: ignore ciphers for h3
  • pop3: TLS upgrade fix
  • runtests: fix the disabling of the memory tracking
  • runtests: quote commands to support paths with spaces
  • scache: add magic checks
  • smb: silence '-Warray-bounds' with gcc 13+
  • smtp: TLS upgrade fix
  • tool_cfgable: sort struct fields by size, use bitfields for booleans
  • tool_getparam: add "TLS required" flag for each such option
  • vtls: fix multissl-init
  • wakeup_write: make sure the eventfd write sends eight bytes

Update to 8.12.0:

• Security fixes:

  • [bsc#1234068, CVE-2024-11053] curl could leak the password used for the first host to the followed-to host under certain circumstances.
  • [bsc#1232528, CVE-2024-9681] HSTS subdomain overwrites parent cache entry
  • [bsc#1236589, CVE-2025-0665] eventfd double close

• Changes:

  • curl: add byte range support to --variable reading from file
  • curl: make --etag-save acknowledge --create-dirs
  • getinfo: fix CURLINFO_QUEUE_TIME_T and add 'time_queue' var
  • getinfo: provide info which auth was used for HTTP and proxy
  • hyper: drop support
  • openssl: add support to use keys and certificates from PKCS#11 provider
  • QUIC: 0RTT for gnutls via CURLSSLOPT_EARLYDATA
  • vtls: feature ssls-export for SSL session im-/export

• Bugfixes:

  • altsvc: avoid integer overflow in expire calculation
  • asyn-ares: acknowledge CURLOPT_DNS_SERVERS set to NULL
  • asyn-ares: fix memory leak
  • asyn-ares: initial HTTPS resolve support
  • asyn-thread: use c-ares to resolve HTTPS RR
  • async-thread: avoid closing eventfd twice
  • cd2nroff: do not insist on quoted <> within backticks
  • cd2nroff: support "none" as a TLS backend
  • conncache: count shutdowns against host and max limits
  • content_encoding: drop support for zlib before 1.2.0.4
  • content_encoding: namespace GZIP flag constants
  • content_encoding: put the decomp buffers into the writer structs
  • content_encoding: support use of custom libzstd memory functions
  • cookie: cap expire times to 400 days
  • cookie: parse only the exact expire date
  • curl: return error if etag options are used with multiple URLs
  • curl_multi_fdset: include the shutdown connections in the set
  • curl_sha512_256: rename symbols to the curl namespace
  • curl_url_set.md: adjust the added-in to 7.62.0
  • doh: send HTTPS RR requests for all HTTP(S) transfers
  • easy: allow connect-only handle reuse with easy_perform
  • easy: make curl_easy_perform() return error if connection still there
  • easy_lock: use Sleep(1) for thread yield on old Windows
  • ECH: update APIs to those agreed with OpenSSL maintainers
  • GnuTLS: fix 'time_appconnect' for early data
  • HTTP/2: strip TE request header
  • http2: fix data_pending check
  • http2: fix value stored to 'result' is never read
  • http: ignore invalid Retry-After times
  • http_aws_sigv4: Fix invalid compare function handling zero-length pairs
  • https-connect: start next immediately on failure
  • lib: redirect handling by protocol handler
  • multi: fix…

Hiroki Kurosawa discovered that curl incorrectly handled certain OCSP responses. This could result in bad certificates not being checked properly, contrary to expectations.