CVE-2024-9681

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>linux-rl9-curl</name>
	<range><lt>8.11.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>When curl is asked to use HSTS, the expiry time for a subdomain
	might
overwrite a parent domain's cache entry, making it end sooner or
	later than
otherwise intended.

This affects curl using applications
	that enable HSTS and use URLs with the
insecure `HTTP://` scheme and
	perform transfers with hosts like
`x.example.com` as well as
	`example.com` where the first host is a subdomain
of the second
	host.

(The HSTS cache either needs to have been populated manually or
	there needs to
have been previous HTTPS accesses done as the cache
	needs to have entries for
the domains involved to trigger this
	problem.)

When `x.example.com` responds with
	`Strict-Transport-Security:` headers, this
bug can make the
	subdomain's expiry timeout *bleed over* and get set for the
parent
	domain `example.com` in curl's HSTS cache.

The result of a triggered
	bug is that HTTP accesses to `example.com` get
converted to HTTPS for
	a different period of time than what was asked for by
the origin
	server. If `example.com` for example stops supporting HTTPS at
	its
expiry time, curl might then fail to access `http://example.com`
	until the
(wrongly set) timeout expires. This bug can also expire the
	parent's entry
*earlier*, thus making curl inadvertently switch back
	to insecure HTTP earlier
than otherwise intended.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2024-9681</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2024-9681</url>
    </references>
    <dates>
      <discovery>2024-11-06</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>