cve-2024-9681
Vulnerability from cvelistv5
Published
2024-11-06 07:47
Modified
2024-12-13 13:09
Severity ?
5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS score ?
0.21% (0.44179)
Summary
When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects curl using applications that enable HSTS and use URLs with the insecure `HTTP://` scheme and perform transfers with hosts like `x.example.com` as well as `example.com` where the first host is a subdomain of the second host. (The HSTS cache either needs to have been populated manually or there needs to have been previous HTTPS accesses done as the cache needs to have entries for the domains involved to trigger this problem.) When `x.example.com` responds with `Strict-Transport-Security:` headers, this bug can make the subdomain's expiry timeout *bleed over* and get set for the parent domain `example.com` in curl's HSTS cache. The result of a triggered bug is that HTTP accesses to `example.com` get converted to HTTPS for a different period of time than what was asked for by the origin server. If `example.com` for example stops supporting HTTPS at its expiry time, curl might then fail to access `http://example.com` until the (wrongly set) timeout expires. This bug can also expire the parent's entry *earlier*, thus making curl inadvertently switch back to insecure HTTP earlier than otherwise intended.
References
2499f714-1537-4658-8207-48ae4bb9eae9https://curl.se/docs/CVE-2024-9681.htmlPatch, Vendor Advisory
2499f714-1537-4658-8207-48ae4bb9eae9https://curl.se/docs/CVE-2024-9681.jsonVendor Advisory
2499f714-1537-4658-8207-48ae4bb9eae9https://hackerone.com/reports/2764830Exploit, Issue Tracking, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2024/11/06/2Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20241213-0006/
Impacted products
Vendor Product Version
curl curl Version: 8.10.1   ≤ 8.10.1
Version: 8.10.0   ≤ 8.10.0
Version: 8.9.1   ≤ 8.9.1
Version: 8.9.0   ≤ 8.9.0
Version: 8.8.0   ≤ 8.8.0
Version: 8.7.1   ≤ 8.7.1
Version: 8.7.0   ≤ 8.7.0
Version: 8.6.0   ≤ 8.6.0
Version: 8.5.0   ≤ 8.5.0
Version: 8.4.0   ≤ 8.4.0
Version: 8.3.0   ≤ 8.3.0
Version: 8.2.1   ≤ 8.2.1
Version: 8.2.0   ≤ 8.2.0
Version: 8.1.2   ≤ 8.1.2
Version: 8.1.1   ≤ 8.1.1
Version: 8.1.0   ≤ 8.1.0
Version: 8.0.1   ≤ 8.0.1
Version: 8.0.0   ≤ 8.0.0
Version: 7.88.1   ≤ 7.88.1
Version: 7.88.0   ≤ 7.88.0
Version: 7.87.0   ≤ 7.87.0
Version: 7.86.0   ≤ 7.86.0
Version: 7.85.0   ≤ 7.85.0
Version: 7.84.0   ≤ 7.84.0
Version: 7.83.1   ≤ 7.83.1
Version: 7.83.0   ≤ 7.83.0
Version: 7.82.0   ≤ 7.82.0
Version: 7.81.0   ≤ 7.81.0
Version: 7.80.0   ≤ 7.80.0
Version: 7.79.1   ≤ 7.79.1
Version: 7.79.0   ≤ 7.79.0
Version: 7.78.0   ≤ 7.78.0
Version: 7.77.0   ≤ 7.77.0
Version: 7.76.1   ≤ 7.76.1
Version: 7.76.0   ≤ 7.76.0
Version: 7.75.0   ≤ 7.75.0
Version: 7.74.0   ≤ 7.74.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-12-13T13:09:28.285Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  url: "http://www.openwall.com/lists/oss-security/2024/11/06/2",
               },
               {
                  url: "https://security.netapp.com/advisory/ntap-20241213-0006/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:curl:curl:*:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "curl",
                  vendor: "curl",
                  versions: [
                     {
                        lessThan: "7.74.0",
                        status: "unaffected",
                        version: "0",
                        versionType: "semver",
                     },
                     {
                        lessThanOrEqual: "8.10.1",
                        status: "affected",
                        version: "7.74.0",
                        versionType: "semver",
                     },
                     {
                        lessThan: "*",
                        status: "unaffected",
                        version: "8.11.0",
                        versionType: "semver",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  cvssV3_1: {
                     attackComplexity: "HIGH",
                     attackVector: "NETWORK",
                     availabilityImpact: "NONE",
                     baseScore: 5.9,
                     baseSeverity: "MEDIUM",
                     confidentialityImpact: "NONE",
                     integrityImpact: "HIGH",
                     privilegesRequired: "NONE",
                     scope: "UNCHANGED",
                     userInteraction: "NONE",
                     vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
                     version: "3.1",
                  },
               },
               {
                  other: {
                     content: {
                        id: "CVE-2024-9681",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-06T16:16:59.652768Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-06T17:09:00.777Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "curl",
               vendor: "curl",
               versions: [
                  {
                     lessThanOrEqual: "8.10.1",
                     status: "affected",
                     version: "8.10.1",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "8.10.0",
                     status: "affected",
                     version: "8.10.0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "8.9.1",
                     status: "affected",
                     version: "8.9.1",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "8.9.0",
                     status: "affected",
                     version: "8.9.0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "8.8.0",
                     status: "affected",
                     version: "8.8.0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "8.7.1",
                     status: "affected",
                     version: "8.7.1",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "8.7.0",
                     status: "affected",
                     version: "8.7.0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "8.6.0",
                     status: "affected",
                     version: "8.6.0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "8.5.0",
                     status: "affected",
                     version: "8.5.0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "8.4.0",
                     status: "affected",
                     version: "8.4.0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "8.3.0",
                     status: "affected",
                     version: "8.3.0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "8.2.1",
                     status: "affected",
                     version: "8.2.1",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "8.2.0",
                     status: "affected",
                     version: "8.2.0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "8.1.2",
                     status: "affected",
                     version: "8.1.2",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "8.1.1",
                     status: "affected",
                     version: "8.1.1",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "8.1.0",
                     status: "affected",
                     version: "8.1.0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "8.0.1",
                     status: "affected",
                     version: "8.0.1",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "8.0.0",
                     status: "affected",
                     version: "8.0.0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "7.88.1",
                     status: "affected",
                     version: "7.88.1",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "7.88.0",
                     status: "affected",
                     version: "7.88.0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "7.87.0",
                     status: "affected",
                     version: "7.87.0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "7.86.0",
                     status: "affected",
                     version: "7.86.0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "7.85.0",
                     status: "affected",
                     version: "7.85.0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "7.84.0",
                     status: "affected",
                     version: "7.84.0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "7.83.1",
                     status: "affected",
                     version: "7.83.1",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "7.83.0",
                     status: "affected",
                     version: "7.83.0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "7.82.0",
                     status: "affected",
                     version: "7.82.0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "7.81.0",
                     status: "affected",
                     version: "7.81.0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "7.80.0",
                     status: "affected",
                     version: "7.80.0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "7.79.1",
                     status: "affected",
                     version: "7.79.1",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "7.79.0",
                     status: "affected",
                     version: "7.79.0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "7.78.0",
                     status: "affected",
                     version: "7.78.0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "7.77.0",
                     status: "affected",
                     version: "7.77.0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "7.76.1",
                     status: "affected",
                     version: "7.76.1",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "7.76.0",
                     status: "affected",
                     version: "7.76.0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "7.75.0",
                     status: "affected",
                     version: "7.75.0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "7.74.0",
                     status: "affected",
                     version: "7.74.0",
                     versionType: "semver",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               type: "finder",
               value: "newfunction",
            },
            {
               lang: "en",
               type: "remediation developer",
               value: "Daniel Stenberg",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "When curl is asked to use HSTS, the expiry time for a subdomain might\noverwrite a parent domain's cache entry, making it end sooner or later than\notherwise intended.\n\nThis affects curl using applications that enable HSTS and use URLs with the\ninsecure `HTTP://` scheme and perform transfers with hosts like\n`x.example.com` as well as `example.com` where the first host is a subdomain\nof the second host.\n\n(The HSTS cache either needs to have been populated manually or there needs to\nhave been previous HTTPS accesses done as the cache needs to have entries for\nthe domains involved to trigger this problem.)\n\nWhen `x.example.com` responds with `Strict-Transport-Security:` headers, this\nbug can make the subdomain's expiry timeout *bleed over* and get set for the\nparent domain `example.com` in curl's HSTS cache.\n\nThe result of a triggered bug is that HTTP accesses to `example.com` get\nconverted to HTTPS for a different period of time than what was asked for by\nthe origin server. If `example.com` for example stops supporting HTTPS at its\nexpiry time, curl might then fail to access `http://example.com` until the\n(wrongly set) timeout expires. This bug can also expire the parent's entry\n*earlier*, thus making curl inadvertently switch back to insecure HTTP earlier\nthan otherwise intended.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "CWE-1025 Comparison Using Wrong Factors",
                     lang: "en",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-06T07:47:20.162Z",
            orgId: "2499f714-1537-4658-8207-48ae4bb9eae9",
            shortName: "curl",
         },
         references: [
            {
               name: "json",
               url: "https://curl.se/docs/CVE-2024-9681.json",
            },
            {
               name: "www",
               url: "https://curl.se/docs/CVE-2024-9681.html",
            },
            {
               name: "issue",
               url: "https://hackerone.com/reports/2764830",
            },
         ],
         title: "HSTS subdomain overwrites parent cache entry",
      },
   },
   cveMetadata: {
      assignerOrgId: "2499f714-1537-4658-8207-48ae4bb9eae9",
      assignerShortName: "curl",
      cveId: "CVE-2024-9681",
      datePublished: "2024-11-06T07:47:20.162Z",
      dateReserved: "2024-10-09T07:57:47.318Z",
      dateUpdated: "2024-12-13T13:09:28.285Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      nvd: "{\"cve\":{\"id\":\"CVE-2024-9681\",\"sourceIdentifier\":\"2499f714-1537-4658-8207-48ae4bb9eae9\",\"published\":\"2024-11-06T08:15:03.740\",\"lastModified\":\"2024-12-13T14:15:22.953\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"When curl is asked to use HSTS, the expiry time for a subdomain might\\noverwrite a parent domain's cache entry, making it end sooner or later than\\notherwise intended.\\n\\nThis affects curl using applications that enable HSTS and use URLs with the\\ninsecure `HTTP://` scheme and perform transfers with hosts like\\n`x.example.com` as well as `example.com` where the first host is a subdomain\\nof the second host.\\n\\n(The HSTS cache either needs to have been populated manually or there needs to\\nhave been previous HTTPS accesses done as the cache needs to have entries for\\nthe domains involved to trigger this problem.)\\n\\nWhen `x.example.com` responds with `Strict-Transport-Security:` headers, this\\nbug can make the subdomain's expiry timeout *bleed over* and get set for the\\nparent domain `example.com` in curl's HSTS cache.\\n\\nThe result of a triggered bug is that HTTP accesses to `example.com` get\\nconverted to HTTPS for a different period of time than what was asked for by\\nthe origin server. If `example.com` for example stops supporting HTTPS at its\\nexpiry time, curl might then fail to access `http://example.com` until the\\n(wrongly set) timeout expires. This bug can also expire the parent's entry\\n*earlier*, thus making curl inadvertently switch back to insecure HTTP earlier\\nthan otherwise intended.\"},{\"lang\":\"es\",\"value\":\"Cuando se le pide a curl que use HSTS, el tiempo de expiración de un subdominio puede sobrescribir la entrada de caché de un dominio principal, lo que hace que finalice antes o después de lo previsto. Esto afecta a curl que usa aplicaciones que habilitan HSTS y usan URL con el esquema inseguro `HTTP://` y realizan transferencias con hosts como `x.example.com` así como `example.com` donde el primer host es un subdominio del segundo host. (El caché HSTS debe haberse llenado manualmente o debe haber habido accesos HTTPS previos ya que el caché debe tener entradas para los dominios involucrados para activar este problema). Cuando `x.example.com` responde con encabezados `Strict-Transport-Security:`, este error puede hacer que el tiempo de expiración del subdominio *se extienda* y se configure para el dominio principal `example.com` en el caché HSTS de curl. El resultado de un error activado es que los accesos HTTP a `example.com` se convierten a HTTPS durante un período de tiempo diferente al solicitado por el servidor de origen. Si `example.com`, por ejemplo, deja de admitir HTTPS en su momento de vencimiento, curl podría entonces no poder acceder a `http://example.com` hasta que expire el tiempo de espera (configurado incorrectamente). Este error también puede hacer que la entrada principal expire *antes*, lo que hace que curl vuelva inadvertidamente a HTTP inseguro antes de lo previsto.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.2,\"impactScore\":4.2},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":5.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.2,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-697\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.74.0\",\"versionEndExcluding\":\"8.11.0\",\"matchCriteriaId\":\"D26CBA59-021E-46CB-A1A0-5AD682F6685E\"}]}]}],\"references\":[{\"url\":\"https://curl.se/docs/CVE-2024-9681.html\",\"source\":\"2499f714-1537-4658-8207-48ae4bb9eae9\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://curl.se/docs/CVE-2024-9681.json\",\"source\":\"2499f714-1537-4658-8207-48ae4bb9eae9\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://hackerone.com/reports/2764830\",\"source\":\"2499f714-1537-4658-8207-48ae4bb9eae9\",\"tags\":[\"Exploit\",\"Issue Tracking\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2024/11/06/2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20241213-0006/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
      vulnrichment: {
         containers: "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://www.openwall.com/lists/oss-security/2024/11/06/2\"}, {\"url\": \"https://security.netapp.com/advisory/ntap-20241213-0006/\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-12-13T13:09:28.285Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.9, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-9681\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-11-06T16:16:59.652768Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:curl:curl:*:*:*:*:*:*:*:*\"], \"vendor\": \"curl\", \"product\": \"curl\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"7.74.0\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"7.74.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.10.1\"}, {\"status\": \"unaffected\", \"version\": \"8.11.0\", \"lessThan\": \"*\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-11-06T16:17:14.568Z\"}}], \"cna\": {\"title\": \"HSTS subdomain overwrites parent cache entry\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"newfunction\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Daniel Stenberg\"}], \"affected\": [{\"vendor\": \"curl\", \"product\": \"curl\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.10.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.10.1\"}, {\"status\": \"affected\", \"version\": \"8.10.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.10.0\"}, {\"status\": \"affected\", \"version\": \"8.9.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.9.1\"}, {\"status\": \"affected\", \"version\": \"8.9.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.9.0\"}, {\"status\": \"affected\", \"version\": \"8.8.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.8.0\"}, {\"status\": \"affected\", \"version\": \"8.7.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.7.1\"}, {\"status\": \"affected\", \"version\": \"8.7.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.7.0\"}, {\"status\": \"affected\", \"version\": \"8.6.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.6.0\"}, {\"status\": \"affected\", \"version\": \"8.5.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.5.0\"}, {\"status\": \"affected\", \"version\": \"8.4.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.4.0\"}, {\"status\": \"affected\", \"version\": \"8.3.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.3.0\"}, {\"status\": \"affected\", \"version\": \"8.2.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.2.1\"}, {\"status\": \"affected\", \"version\": \"8.2.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.2.0\"}, {\"status\": \"affected\", \"version\": \"8.1.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.1.2\"}, {\"status\": \"affected\", \"version\": \"8.1.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.1.1\"}, {\"status\": \"affected\", \"version\": \"8.1.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.1.0\"}, {\"status\": \"affected\", \"version\": \"8.0.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.0.1\"}, {\"status\": \"affected\", \"version\": \"8.0.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.0.0\"}, {\"status\": \"affected\", \"version\": \"7.88.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.88.1\"}, {\"status\": \"affected\", \"version\": \"7.88.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.88.0\"}, {\"status\": \"affected\", \"version\": \"7.87.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.87.0\"}, {\"status\": \"affected\", \"version\": \"7.86.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.86.0\"}, {\"status\": \"affected\", \"version\": \"7.85.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.85.0\"}, {\"status\": \"affected\", \"version\": \"7.84.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.84.0\"}, {\"status\": \"affected\", \"version\": \"7.83.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.83.1\"}, {\"status\": \"affected\", \"version\": \"7.83.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.83.0\"}, {\"status\": \"affected\", \"version\": \"7.82.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.82.0\"}, {\"status\": \"affected\", \"version\": \"7.81.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.81.0\"}, {\"status\": \"affected\", \"version\": \"7.80.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.80.0\"}, {\"status\": \"affected\", \"version\": \"7.79.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.79.1\"}, {\"status\": \"affected\", \"version\": \"7.79.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.79.0\"}, {\"status\": \"affected\", \"version\": \"7.78.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.78.0\"}, {\"status\": \"affected\", \"version\": \"7.77.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.77.0\"}, {\"status\": \"affected\", \"version\": \"7.76.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.76.1\"}, {\"status\": \"affected\", \"version\": \"7.76.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.76.0\"}, {\"status\": \"affected\", \"version\": \"7.75.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.75.0\"}, {\"status\": \"affected\", \"version\": \"7.74.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.74.0\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://curl.se/docs/CVE-2024-9681.json\", \"name\": \"json\"}, {\"url\": \"https://curl.se/docs/CVE-2024-9681.html\", \"name\": \"www\"}, {\"url\": \"https://hackerone.com/reports/2764830\", \"name\": \"issue\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"When curl is asked to use HSTS, the expiry time for a subdomain might\\noverwrite a parent domain's cache entry, making it end sooner or later than\\notherwise intended.\\n\\nThis affects curl using applications that enable HSTS and use URLs with the\\ninsecure `HTTP://` scheme and perform transfers with hosts like\\n`x.example.com` as well as `example.com` where the first host is a subdomain\\nof the second host.\\n\\n(The HSTS cache either needs to have been populated manually or there needs to\\nhave been previous HTTPS accesses done as the cache needs to have entries for\\nthe domains involved to trigger this problem.)\\n\\nWhen `x.example.com` responds with `Strict-Transport-Security:` headers, this\\nbug can make the subdomain's expiry timeout *bleed over* and get set for the\\nparent domain `example.com` in curl's HSTS cache.\\n\\nThe result of a triggered bug is that HTTP accesses to `example.com` get\\nconverted to HTTPS for a different period of time than what was asked for by\\nthe origin server. If `example.com` for example stops supporting HTTPS at its\\nexpiry time, curl might then fail to access `http://example.com` until the\\n(wrongly set) timeout expires. This bug can also expire the parent's entry\\n*earlier*, thus making curl inadvertently switch back to insecure HTTP earlier\\nthan otherwise intended.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"description\": \"CWE-1025 Comparison Using Wrong Factors\"}]}], \"providerMetadata\": {\"orgId\": \"2499f714-1537-4658-8207-48ae4bb9eae9\", \"shortName\": \"curl\", \"dateUpdated\": \"2024-11-06T07:47:20.162Z\"}}}",
         cveMetadata: "{\"cveId\": \"CVE-2024-9681\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-13T13:09:28.285Z\", \"dateReserved\": \"2024-10-09T07:57:47.318Z\", \"assignerOrgId\": \"2499f714-1537-4658-8207-48ae4bb9eae9\", \"datePublished\": \"2024-11-06T07:47:20.162Z\", \"assignerShortName\": \"curl\"}",
         dataType: "CVE_RECORD",
         dataVersion: "5.1",
      },
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.