CVE-2024-8096
MediumSummary
When curl is told to use the Certificate Status Request TLS extension (OCSP stapling) to verify the server certificate, it might fail to detect some OCSP problems and wrongly consider the response as fine if the returned status reports another error than expected.
Risk Assessment
This may allow acceptance of invalid certificates, increasing the risk of man-in-the-middle attacks.
Recommendation
Update curl to a patched version and consider additional certificate verification mechanisms.
Original NVD description (English source)
When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than