Inadvertently Storing SSL Session IDs in Cache Leads to Security Risks

CVE-2024-0853

What is CVE-2024-0853?

curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (OCSP stapling) test failed. A subsequent transfer to the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.

References