Bug 2262097 (CVE-2024-0853)

Summary:	CVE-2024-0853 curl: OCSP verification bypass with TLS session reuse
Product:	[Other] Security Response	Reporter:	Mauro Matteo Cascella <mcascell>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	aarif, abuckta, agarcial, aoconnor, apatel, aprice, asegurap, bdettelb, caswilli, cmyers, crizzo, csutherl, dfreiber, dkuc, dnakabaa, doconnor, drow, eshamard, fjansen, gtanzill, hhorak, hkataria, jburrell, jbuscemi, jclere, jdobes, jmitchel, jorton, jsamir, jsherril, jtanner, jvasik, kaycoth, kdudka, kgaikwad, kshier, lcouzens, luhliari, luizcosta, mpierce, nweather, oezr, orabin, pjindal, plodge, rblanco, rhel-process-autobot, stcannon, sthirugn, supatil, szappis, teagle, tsasak, vchlup, vkrizan, vkumar, vmugicag, watson-tool-maintainers, xiaoxwan, yguenane, zzhou
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	curl 8.6.0	Doc Type:	---
Doc Text:	A flaw was found in Curl, where it inadvertently kept the SSL session ID for connections in its cache even when the verify status, OCSP stapling test, failed. A subsequent transfer to the same hostname could succeed if the session ID cache were still fresh, which then skips the verify status check.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2262099

Description Mauro Matteo Cascella 2024-01-31 14:20:33 UTC

curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (OCSP stapling) test failed. A subsequent transfer to the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check. This issue is limited to curl built to use OpenSSL and when using TLS 1.2 only and not TLS 1.3. The issue is fixed upstream in curl 8.6.0. 

References:
https://curl.se/docs/CVE-2024-0853.html
https://www.openwall.com/lists/oss-security/2024/01/31/1

Upstream fix:
https://github.com/curl/curl/commit/c28e9478cb2548848ec