Skip to content
OpenAdvisories
Low ALAS2023-2024-581 1 CVE

Low: curl security update (Amazon Linux 2023)

Published Mar 27, 2024 · Updated Mar 27, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-0853: A flaw was found in Curl, where it inadvertently kept the SSL session ID for connections in its cache even when the verify status, OCSP stapling test, failed. A subsequent transfer to the same hostname could succeed if the session ID cache were still fresh, which then skips the verify status check.

Fixed packages 10

ReleasePackageFixed in
Amazon Linux · 2023 curl 0:8.5.0-1.amzn2023.0.3
Amazon Linux · 2023 curl-debuginfo 0:8.5.0-1.amzn2023.0.3
Amazon Linux · 2023 curl-debugsource 0:8.5.0-1.amzn2023.0.3
Amazon Linux · 2023 curl-minimal 0:8.5.0-1.amzn2023.0.3
Amazon Linux · 2023 curl-minimal-debuginfo 0:8.5.0-1.amzn2023.0.3
Amazon Linux · 2023 libcurl 0:8.5.0-1.amzn2023.0.3
Amazon Linux · 2023 libcurl-debuginfo 0:8.5.0-1.amzn2023.0.3
Amazon Linux · 2023 libcurl-devel 0:8.5.0-1.amzn2023.0.3
Amazon Linux · 2023 libcurl-minimal 0:8.5.0-1.amzn2023.0.3
Amazon Linux · 2023 libcurl-minimal-debuginfo 0:8.5.0-1.amzn2023.0.3

Vulnerabilities 1

  • Medium 5.3
    CVE-2024-0853

    OCSP verification bypass with TLS session reuse

    curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed. A subsequent transfer to the same hostname could then succeed if the session ID cache was still fresh, which then skipped the ve…

    curl curl curl curl Debian Ubuntu Azure Linux Alpine Wolfi

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-0853.html