6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2024-8096

CVE-2024-8096: When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP...

When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2024-8096

CVE-2024-8096:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability CVE-2024-8096 states that curl, when using GnuTLS for OCSP stapling, might incorrectly consider a certificate fine if the OCSP status reports an error other than 'revoked' (e.g., 'unauthorized').

The introducing commit (f13669a375f) added OCSP support in lib/vtls/gtls.c. The function gtls_connect_step3 implemented the check using gnutls_ocsp_status_request_is_checked(). If this function did not return 0 (indicating a problem or 'not good' status), an else branch was taken which logged 'SSL server certificate status verification OK' and proceeded. This else branch is the vulnerable path if gnutls_ocsp_status_request_is_checked() incorrectly returned 1 (good) for an OCSP error like 'unauthorized'.

The fixing commit (aeb1a281cab) modified the function Curl_gtls_verifyserver in the same file. It removed the old logic based on gnutls_ocsp_status_request_is_checked() and replaced it with a more robust check that explicitly fetches the OCSP status details (gnutls_ocsp_status_request_get, gnutls_ocsp_resp_import, gnutls_ocsp_resp_get_single) and then fails if the status is anything other than GNUTLS_OCSP_CERT_GOOD.

Both gtls_connect_step3 (where the vulnerable logic was introduced) and Curl_gtls_verifyserver (where the vulnerable logic was present and then fixed) are identified as vulnerable. The core issue was the misinterpretation or insufficient handling of the return value from gnutls_ocsp_status_request_is_checked(), leading to an incorrect 'OK' status for certain OCSP errors.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.