Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 942952 (CVE-2024-9681)

Summary: net-misc/curl: HSTS subdomain overwrites parent cache entry
Product: Gentoo Security Reporter: Christopher Fore <csfore>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: CONFIRMED ---    
Severity: normal CC: base-system, kangie
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
URL: https://curl.se/docs/CVE-2024-9681.html
Whiteboard: B3 [ebuild]
Package list:
Runtime testing required: ---

Description Christopher Fore 2024-11-06 14:03:02 UTC
CVE-2024-9681:

When curl is asked to use HSTS, the expiry time for a subdomain might                                                                        
overwrite a parent domain's cache entry, making it end sooner or later than                                                                  
otherwise intended.                                                                                                                          
                                                                                                                                             
This affects curl using applications that enable HSTS and use URLs with the                                                                  
insecure `HTTP://` scheme and perform transfers with hosts like                                                                              
`x.example.com` as well as `example.com` where the first host is a subdomain                                                                 
of the second host.                                                                                                                          
                                                                                                                                             
(The HSTS cache either needs to have been populated manually or there needs to                                                               
have been previous HTTPS accesses done as the cache needs to have entries for                                                                
the domains involved to trigger this problem.)                                                                                               
                                                                                                                                             
When `x.example.com` responds with `Strict-Transport-Security:` headers, this                                                                
bug can make the subdomain's expiry timeout *bleed over* and get set for the                                                                 
parent domain `example.com` in curl's HSTS cache.                                                                                            
                                                                                                                                             
The result of a triggered bug is that HTTP accesses to `example.com` get                                                                     
converted to HTTPS for a different period of time than what was asked for by                                                                 
the origin server. If `example.com` for example stops supporting HTTPS at its                                                                
expiry time, curl might then fail to access `http://example.com` until the                                                                   
(wrongly set) timeout expires. This bug can also expire the parent's entry                                                                   
*earlier*, thus making curl inadvertently switch back to insecure HTTP earlier                                                               
than otherwise intended.



The above is fixed in 8.11.0.