curl-8.10.1

[Bruce Dubbs]

New minor version.

[Douglas R. Reno]

OCSP stapling bypass with GnuTLS
================================

Project curl Security Advisory, September 11th 2024 -
[Permalink](https://curl.se/docs/CVE-2024-8096.html)

VULNERABILITY
-------------

When curl is told to use the Certificate Status Request TLS extension, often
referred to as OCSP stapling, to verify that the server certificate is valid,
it might fail to detect some OCSP problems and instead wrongly consider the
response as fine.

If the returned status reports another error than "revoked" (like for example
"unauthorized") it is not treated as a bad certficate.

INFO
----

This issue only exists when curl is built to use the GnuTLS library. curl can
be made to use a large variety of TLS libraries and GnuTLS is not the most
common choice.

OCSP stapling is not a widely used feature on the open web, perhaps partly
because so many big name sites do not support it.

This bug is **not** considered a *C mistake* (likely to have been avoided had
we not been using C).

This flaw also affects the curl command line tool.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2024-8096 to this issue.

CWE-295: Improper Certificate Validation

Severity: Medium

AFFECTED VERSIONS
-----------------

The vulnerable code can only be reached when curl is built to use GnuTLS.

- Affected versions: curl 7.41.0 to and including 8.9.1
- Not affected versions: curl < 7.41.0 and >= 8.10.0
- Introduced-in: https://github.com/curl/curl/commit/f13669a375f

libcurl is used by many applications, but not always advertised as such!

SOLUTION
------------

- Fixed-in: https://github.com/curl/curl/commit/aeb1a281cab13c7ba

RECOMMENDATIONS
---------------

We suggest you take one of the following actions immediately, in order of
preference:

 A - Upgrade curl and libcurl to version 8.10.0

 B - Apply the patch to your version and rebuild

 C - Build your curl with an unaffected TLS backend

TIMELINE
---------

This issue was reported to the curl project on August 19, 2024. We contacted
distros@openwall on September 3, 2024.

curl 8.10.0 was released on September 11 2024 around 06:00 UTC, coordinated
with the publication of this advisory.

CREDITS
-------

- Reported-by: Hiroki Kurosawa
- Patched-by: Daniel Stenberg

Thanks a lot!

Note that this does not affect a default BLFS system, but we do mention the options required to use GnuTLS. As a result I'll make sure to note that when the security advisory is filed.

[Douglas R. Reno]

Hold until 8.10.1 on Wednesday

Hello,

Just as we feared; among the ridiculous amount of changes and bugfixes we landed in 
8.10.0 we also let a few regressions slip in. Some of them nasty enough to warrant a 
patch release.

Thus: we now focus and aim for a 8.10.1 release on Wednesday September 18. It gives us a 
few more days to gather issues, merge bugfixes and then to get our release ducks in 
order without rushing anything.

So please: if you find an ever so small issue with 8.10.0, please let us know asap and 
we might have a change to fix it really quicky.

Thanks for flying curl. Never a dull moment. 

[Douglas R. Reno]

Now 8.10.1. This ticket should now be doable