OCSP stapling bypass with Apple SecTrust
Platform
curl
Component
curl
Fixed in
8.19.1
When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it fails to detect OCSP problems and instead wrongly consider the response as fine.
Threat Intelligence
Exploit Status
EPSS
0.01% (1% percentile)
Affected Software
Weakness Classification (CWE)
Timeline
- Reserved
- Published
- EPSS updated
How to fix
Actualice a la versión 8.19.1 o superior para corregir la vulnerabilidad. Esta actualización aborda un problema donde curl no detectaba correctamente problemas de OCSP, lo que podría llevar a una validación incorrecta de certificados.
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Try it now — no account
Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
Drag & drop your dependency file
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...