curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP respon

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• apple mac os xbefore 10.14.6
• apple mac os x10.15 and later · before 10.15.7
• apple mac os x10.14.6
• apple mac os x10.15.7
• apple macos11.0 and later · before 11.3
• debian debian linux10.0
• debian debian linux9.0
• fedoraproject fedora32
• fedoraproject fedora33
• haxx libcurl7.41.0 and later · before 7.74.0
• netapp clustered data ontapall versions
• netapp hci bootstrap osall versions
• netapp hci management nodeall versions
• netapp hci storage node firmwareall versions
• netapp solidfireall versions
• oracle communications billing and revenue management12.0.0.3.0
• oracle communications cloud native core policy1.14.0
• oracle essbase21.2
• oracle peoplesoft enterprise peopletools8.58
• siemens simatic tim 1531 irc firmwareup to 2.2 inclusive

Versions reported by the vendor

Affected version ranges reported by the assigning authority (hackerone). Independent of NVD's CPE analysis and usually ahead of it.

• n/a https://github.com/curl/curl

  • 7.41.0 to and including 7.73.0affected

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2023-38545This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake.
  63This week
• CVE-2019-5436A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.
  46Plan
• CVE-2019-3822libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow.
  43Plan
• CVE-2018-14618curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code.
  42Plan
• CVE-2016-8622The URL percent-encoding decode function in libcurl before 7.51.0 is called `curl_easy_unescape`.
  40Plan
• CVE-2021-22945When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed
  38Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

A certificate validation error is silently swallowed instead of terminating the connection. Often, code added for a test environment makes its way into production.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1override fun checkServerTrusted(chain: Array<X509Certificate>, type: String) {2  // Left empty for the test environment3}

1val client = OkHttpClient.Builder()2  .certificatePinner(3    CertificatePinner.Builder()4      .add("api.sirius.example", "sha256/…")5      .build()6  ).build()

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.