CVE-2024-45289: Fetch Library CRL Bypass Vulnerability

CVE-2024-45289 Overview

CVE-2024-45289 affects the FreeBSD fetch(1) utility and its underlying fetch(3) library. The fetch(3) library reads the certificate revocation list (CRL) pathname from an environment variable. However, fetch(1) exports the filename under an incorrect environment variable name, which the library does not read. As a result, the --crl command-line option is silently ignored. The utility then completes TLS connections to hosts presenting certificates that the operator explicitly marked as revoked. This issue is tracked as an improper initialization weakness ([CWE-665]).

Critical Impact
Operators who rely on fetch --crl to block revoked TLS certificates receive no protection. Connections to hosts using compromised or revoked certificates succeed without warning.

Affected Products

FreeBSD operating system fetch(1) utility
FreeBSD libfetch / fetch(3) library
NetApp products incorporating affected FreeBSD components (per NetApp advisory NTAP-20250110-0001)

Discovery Timeline

2024-11-12 - CVE-2024-45289 published to NVD with FreeBSD Security Advisory SA-24:18
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-45289

Vulnerability Analysis

The fetch(3) library accepts configuration data through environment variables, including the path to a PEM-encoded certificate revocation list. The fetch(1) command-line wrapper exposes a --crl option intended to pass that path to the library. The wrapper writes the filename into an environment variable, but the variable name does not match the one the library reads at runtime. The library therefore proceeds with an empty revocation list. TLS handshakes complete successfully against any server certificate that chains to a trusted certificate authority, even when the operator listed that certificate in the CRL file.

The failure undermines a security control that administrators explicitly enabled. Confidentiality of fetched content is impacted because the client trusts attacker-controlled or compromised endpoints. Integrity and availability of the host system are not directly affected, which aligns with the CVSS metrics published with the advisory.

Root Cause

The defect is an improper initialization of trust state ([CWE-665]). The fetch(1) front end sets one environment variable name while libfetch reads a different name. No error is returned, so the operator has no indication that the revocation list was ignored. The mismatch is a coding error in the FreeBSD source tree rather than a protocol-level TLS flaw.

Attack Vector

An attacker who possesses a revoked but still-trusted certificate, for example a certificate stolen from a compromised origin before its owner published a revocation, can present that certificate to a FreeBSD client running fetch --crl. The client validates the chain, ignores the local CRL, and downloads content from the attacker-controlled endpoint. This enables man-in-the-middle interception and supply-chain substitution when fetch is used in package retrieval, build automation, or update scripts. Network access to the targeted client connection is the only prerequisite, and no user interaction is required beyond invoking fetch as designed.

No public proof-of-concept code is available. Reproduction requires presenting a revoked certificate to a fetch client invoked with --crl and observing that the connection succeeds.

Detection Methods for CVE-2024-45289

Indicators of Compromise

Successful TLS connections from fetch(1) to hosts whose certificates appear in a configured CRL file
Package or file downloads completing despite --crl being specified on the command line
Absence of any error or warning message when fetch --crl /path/to/crl.pem is invoked against a revoked endpoint

Detection Strategies

Inventory FreeBSD hosts and compare installed fetch and libfetch versions against the patched releases listed in FreeBSD-SA-24:18
Audit shell scripts, package managers, and automation that invoke fetch --crl and treat them as unprotected until the host is patched
Verify behavior in a lab by serving a revoked certificate and confirming whether fetch --crl blocks or accepts the connection

Monitoring Recommendations

Capture process execution telemetry for fetch invocations and log the full command line, including --crl arguments
Forward TLS handshake metadata from outbound proxies to correlate fetch traffic against known revoked certificate serial numbers
Alert on fetch connections to destinations outside an approved allow-list of mirrors and update servers

How to Mitigate CVE-2024-45289

Immediate Actions Required

Apply the FreeBSD security update referenced in FreeBSD Security Advisory SA-24:18
For NetApp products, follow remediation steps in NetApp Security Advisory NTAP-20250110-0001
Treat any prior fetch --crl operations as if no revocation checking occurred and re-validate downloaded artifacts

Patch Information

FreeBSD published Security Advisory SA-24:18 with corrected source and binary updates that align the environment variable name written by fetch(1) with the name read by libfetch. Apply the advisory's freebsd-update instructions or rebuild from the patched source branch. NetApp issued NTAP-20250110-0001 with product-specific guidance for affected appliances.

Workarounds

Pin trusted certificates explicitly using --ca-cert against a curated bundle that excludes known-revoked issuers, rather than relying on --crl
Restrict fetch traffic to known-good mirrors through firewall egress rules until patches are deployed
Replace fetch with an alternative client such as curl or wget in scripts that depend on CRL enforcement, after validating those clients honor the supplied revocation list

bash

# Verify the installed FreeBSD patch level addresses SA-24:18
freebsd-version -k
freebsd-update fetch
freebsd-update install

# Pending patching, prefer an explicit trust bundle over --crl
fetch --ca-cert=/etc/ssl/curated-bundle.pem https://mirror.example.org/pkg.txz