- -------------------------------------------------------------------------
Debian LTS Advisory DLA-3951-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                          Abhijith PA
November 14, 2024                             https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : curl
Version        : 7.74.0-1.3+deb11u14
CVE ID         : CVE-2024-8096


curl a command line tool for transferring data with URL syntax was
affected by CVE-2024-8096. When the TLS backend is GnuTLS, curl may
incorrectly handle OCSP stapling. If the OCSP status reports an error
other than "revoked" (e.g., "unauthorized"), it is not treated as a
bad certificate, potentially allowing invalid certificates to be
considered valid.

For Debian 11 bullseye, this problem has been fixed in version
7.74.0-1.3+deb11u14.

We recommend that you upgrade your curl packages.

For the detailed security status of curl please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/curl

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS