Critical SSL Session ID Caching Vulnerability in curl Package
Summary
DEBIAN-CVE-2024-0853: curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed. Affects curl versions < 8.6.0-1. Fixed in 8.6.0-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The curl package is a widely used command-line tool and library for transferring data with URLs. It supports various protocols including HTTP, HTTPS, FTP, and more, making it essential for web applications and services. The package is known for its versatility and ease of use, but it has recently been identified as vulnerable to a critical issue that affects its SSL session handling.
Vulnerability Detail
The vulnerability arises from curl's handling of SSL session IDs, where it inadvertently retains the session ID in its cache even when the OCSP stapling verification fails. This means that if a subsequent connection to the same hostname is made, it could succeed using the cached session ID, bypassing the necessary verification checks. This flaw could lead to potential security risks, including man-in-the-middle attacks, as the integrity of the SSL connection may not be guaranteed.
How To Fix
Minimum fixed version
8.6.0-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the use of cached SSL session IDs by modifying their curl commands to include the option '--no-sessionid'. This will prevent curl from using any cached session IDs, thereby enforcing a fresh verification for each connection.
Conclusion
In summary, the curl package has a critical vulnerability related to SSL session ID caching that can compromise the security of data transfers. Users are strongly advised to update to the latest patched version to mitigate risks. Additionally, temporary workarounds are available to enhance security until the update can be applied.
See every vulnerability recorded for curl →
FAQ
The vulnerability can lead to insecure SSL connections, allowing attackers to potentially intercept or manipulate data transmitted over the network.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Yes, not updating curl exposes your application to security risks, including potential man-in-the-middle attacks.
Versions of curl prior to 8.6.0-1 are affected by this vulnerability.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for curl.
