Internet Bug Bounty: CVE-2024-0853: OCSP verification bypass with TLS session reuse

🗓️ 31 Jan 2024 13:23:36Reported by kurohiroType

hackerone🔗 hackerone.com👁 63 Views

Internet Bug Bounty: TLS session OCSP bypas

Reporter	Title	Published	Views	Family All 80
FreeBSD	curl -- OCSP verification bypass with TLS session reuse	31 Jan 202400:00	–	freebsd
IBM Security Bulletins	Security Bulletin: AIX is vulnerable to security restrictions bypass due to cURL libcurl (CVE-2024-0853)	20 Jun 202422:03	–	ibm
IBM Security Bulletins	Security Bulletin: Due to use of HCL BigFix , IBM Cloud Pak System is affected by multiple vulnerabilities	7 Oct 202600:53	–	ibm
IBM Security Bulletins	Security Bulletin: PowerSC is vulnerable to security restrictions bypass due to Curl (CVE-2023-46218, CVE-2023-46219, CVE-2024-0853)	20 Mar 202418:41	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MaaS360 Cloud Extender Agent, Configuration Utility, Email Notification, Real Time Action and Base Module affected by multiple vulnerabilities (CVE-2023-46219, CVE-2023-46218, CVE-2023-52071, CVE-2024-0853)	15 Apr 202502:30	–	ibm
Tenable Nessus	Amazon Linux 2023 : curl, curl-minimal, libcurl (ALAS2023-2024-581)	3 Apr 202400:00	–	nessus
Tenable Nessus	Azure Linux 3.0 Security Update: curl (CVE-2024-0853)	10 Feb 202500:00	–	nessus
Tenable Nessus	Rocky Linux 9.6 [CIQ] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ciqsa-2026_1401)	1 Oct 202600:00	–	nessus
Tenable Nessus	Curl 8.5.0 < 8.6.0 Security Bypass (CVE-2024-0853)	2 Feb 202400:00	–	nessus
Tenable Nessus	FreeBSD : curl -- OCSP verification bypass with TLS session reuse (02e33cd1-c655-11ee-8613-08002784c58d)	28 Feb 202400:00	–	nessus

27 Mar 2024 17:37Current

4.6Medium risk

Vulners AI Score4.6

CVSS 3.15.3

EPSS0.01102

internet bug bounty cve-2024-0853 ocsp verification tls session certificate revocation