OCSP verification bypass with TLS session reuse

2024-01-3108:00:00

Google

osv.dev

ssl session cache

ocsp stapling

verify status check

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

AI Score

5.5

Confidence

High

EPSS

0.001

Percentile

24.2%

JSON

curl inadvertently kept the SSL session ID for connections in its cache even
when the verify status (OCSP stapling) test failed. A subsequent transfer to
the same hostname could then succeed if the session ID cache was still fresh,
which then skipped the verify status check.