curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.

An update of the cmake package has been released.

An update of the curl package has been released.

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2023-0808 advisory.

  - The go command may execute arbitrary code at build time when using cgo. This may occur when running go     get on a malicious module, or when running any other command which builds untrusted code. This is can by     triggered by linker flags, specified via a #cgo LDFLAGS directive. Flags containing embedded spaces are     mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in     the argument of another flag. This only affects usage of the gccgo compiler. (CVE-2023-29405)

  - When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by     finalizing the operation with a rename from a temporary name to the final target file name.In that rename     operation, it might accidentally *widen* the permissions for the target file, leaving the updated file     accessible to more users than intended. (CVE-2022-32207)

  - decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS. (CVE-2022-38900)

  - The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.
    (CVE-2022-33987)

  - Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the     name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3. (CVE-2022-37601)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2023-0613 advisory.

  - A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as     @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states we are in     the process of marking this report as invalid; however, some third parties takes the position that A     prototype injection/Prototype pollution is not just when global objects are polluted with recursive merge     or deep cloning but also when a target object is polluted. (CVE-2022-37616)

  - When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by     finalizing the operation with a rename from a temporary name to the final target file name.In that rename     operation, it might accidentally *widen* the permissions for the target file, leaving the updated file     accessible to more users than intended. (CVE-2022-32207)

  - An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the     XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to     access an array at a negative 2GB offset, typically leading to a segmentation fault. (CVE-2022-40303)

  - An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a     hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be     provoked. (CVE-2022-40304)

  - There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName.
    X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME     incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently     interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL     checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may     allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or     enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate     chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these     inputs, the other input must already contain an X.400 address as a CRL distribution point, which is     uncommon. As such, this vulnerability is most likely to only affect applications which have implemented     their own functionality for retrieving CRLs over a network. (CVE-2023-0286)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

On May 26, 2021 curl published security updates addressing 3 CVEs: CVE-2021-22897 (Low) CVE-2021-22898 (Medium)  CVE-2021-22901 (High). Previous releases of Puppet Agent contain this vulnerable version of curl.  For more information  about this vulnerability, refer to the curl ecurity announcements.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

For more information about this vulnerability, refer to the security announcements.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of curl installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-22897 advisory.

  - curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the     code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected     cipher set was stored in a single static variable in the library, which has the surprising side-effect     that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will     accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport     security significantly. (CVE-2021-22897)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - curl 7.1.1 to and including 7.75.0 is vulnerable to an 'Exposure of Private Personal Information to an     Unauthorized Actor' by leaking credentials in the HTTP Referer: header. libcurl does not strip off user     credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing     HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second     HTTP request. (CVE-2021-22876)

  - curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the     code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected     cipher set was stored in a single 'static' variable in the library, which has the surprising side-effect     that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will     accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport     security significantly. (CVE-2021-22897)

  - curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as     `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a     flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized     data from a stack based buffer to the server, resulting in potentially revealing sensitive internal     information to the server using a clear-text network protocol. (CVE-2021-22898)

  - When curl is instructed to download content using the metalink feature, thecontents is verified against a     hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same     contentfrom a set of different URLs, potentially hosted by different servers and theclient can then     download the file from one or several of them. In a serial orparallel manner.If one of the servers hosting     the contents has been breached and the contentsof the specific file on that server is replaced with a     modified payload, curlshould detect this when the hash of the file mismatches after a completeddownload.
    It should remove the contents and instead try getting the contentsfrom another URL. This is not done, and     instead such a hash mismatch is onlymentioned in text and the potentially malicious content is kept in the     file ondisk. (CVE-2021-22922)

  - When curl is instructed to get content using the metalink feature, and a user name and password are used     to download the metalink XML file, those same credentials are then subsequently passed on to each of the     servers from which curl will download or try to download the contents from. Often contrary to the user's     expectations and intentions and without telling the user it happened. (CVE-2021-22923)

  - libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of     them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert'     into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing     wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary     depending on used file systems.The comparison also didn't include the 'issuer cert' which a transfer can     setto qualify how to verify the server certificate. (CVE-2021-22924)

  - curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used     option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for     sending `NEW_ENV` variables, libcurlcould be made to pass on uninitialized data from a stack based buffer     to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-     text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing     the string provided by the application. (CVE-2021-22925)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Junos OS installed on the remote host is affected by multiple vulnerabilities as referenced in the JSA11289 advisory.

  - curl 7.1.1 to and including 7.75.0 is vulnerable to an Exposure of Private Personal Information to an     Unauthorized Actor by leaking credentials in the HTTP Referer: header. libcurl does not strip off user     credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing     HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second     HTTP request. (CVE-2021-22876)

  - curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a     connection due to bad handling of TLS 1.3 session tickets. When using a HTTPS proxy and TLS 1.3, libcurl     can confuse session tickets arriving from the HTTPS proxy but work as if they arrived from the remote     server and then wrongly short-cut the host handshake. When confusing the tickets, a HTTPS proxy can     trick libcurl to use the wrong session ticket resume for the host and thereby circumvent the server TLS     certificate check and make a MITM attack to be possible to perform unnoticed. Note that such a malicious     HTTPS proxy needs to provide a certificate that curl will accept for the MITMed server for an attack to     work - unless curl has been told to ignore the server certificate check. (CVE-2021-22890)

  - curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the     code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected     cipher set was stored in a single static variable in the library, which has the surprising side-effect     that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will     accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport     security significantly. (CVE-2021-22897)

  - curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as     `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a     flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized     data from a stack based buffer to the server, resulting in potentially revealing sensitive internal     information to the server using a clear-text network protocol. (CVE-2021-22898)

  - curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory     being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use this in     rare unfortunate circumstances to potentially reach remote code execution in the client. When libcurl at     run-time sets up support for TLS 1.3 session tickets on a connection using OpenSSL, it stores pointers to     the transfer in-memory object for later retrieval when a session ticket arrives. If the connection is used     by multiple transfers (like with a reused HTTP/1.1 connection or multiplexed HTTP/2 connection) that first     transfer object might be freed before the new session is established on that connection and then the     function will access a memory buffer that might be freed. When using that memory, libcurl might even call     a function pointer in the object, making it possible for a remote code execution if the server could     somehow manage to get crafted memory content into the correct place in memory. (CVE-2021-22901)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - curl is a command line tool for transferring data with     URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP,     SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMAP,     SMTP, POP3 and RTSP. curl supports SSL certificates,     HTTP POST, HTTP PUT, FTP uploading, HTTP form based     upload, proxies, cookies, user+password authentication     (Basic, Digest, NTLM, Negotiate, kerberos...), file     transfer resume, proxy tunneling and a busload of other     useful tricks.Security Fix(es):A flaw was found in curl     where libcurl lets applications specify which specific     TLS ciphers to use in transfers, using the option     called CURLOPT_SSL_CIPHER_LIST. The cipher selection is     used for the TLS negotiation when a transfer is done     involving any of the TLS based transfer protocols     libcurl sup(CVE-2021-22897)curl 7.7 through 7.76.1     suffers from an information disclosure when the `-t`     command line option, known as `CURLOPT_TELNETOPTIONS`     in libcurl, is used to send variable=content pairs to     TELNET servers. Due to a flaw in the option parser for     sending NEW_ENV variables, libcurl could be made to     pass on uninitialized data from a stack based buffer to     the server, resulting in potentially revealing     sensitive internal information to the server using a     clear-text network protocol.(CVE-2021-22898)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - curl 7.7 through 7.76.1 suffers from an information     disclosure when the `-t` command line option, known as     `CURLOPT_TELNETOPTIONS` in libcurl, is used to send     variable=content pairs to TELNET servers. Due to a flaw     in the option parser for sending NEW_ENV variables,     libcurl could be made to pass on uninitialized data     from a stack based buffer to the server, resulting in     potentially revealing sensitive internal information to     the server using a clear-text network     protocol.(CVE-2021-22898)

  - curl 7.61.0 through 7.76.1 suffers from exposure of     data element to wrong session due to a mistake in the     code for CURLOPT_SSL_CIPHER_LIST when libcurl is built     to use the Schannel TLS library. The selected cipher     set was stored in a single 'static' variable in the     library, which has the surprising side-effect that if     an application sets up multiple concurrent transfers,     the last one that sets the ciphers will accidentally     control the set used by all transfers. In a worst-case     scenario, this weakens transport security     significantly.(CVE-2021-22897)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - curl 7.7 through 7.76.1 suffers from an information     disclosure when the `-t` command line option, known as     `CURLOPT_TELNETOPTIONS` in libcurl, is used to send     variable=content pairs to TELNET servers. Due to a flaw     in the option parser for sending NEW_ENV variables,     libcurl could be made to pass on uninitialized data     from a stack based buffer to the server, resulting in     potentially revealing sensitive internal information to     the server using a clear-text network     protocol.(CVE-2021-22898)

  - curl 7.61.0 through 7.76.1 suffers from exposure of     data element to wrong session due to a mistake in the     code for CURLOPT_SSL_CIPHER_LIST when libcurl is built     to use the Schannel TLS library. The selected cipher     set was stored in a single 'static' variable in the     library, which has the surprising side-effect that if     an application sets up multiple concurrent transfers,     the last one that sets the ciphers will accidentally     control the set used by all transfers. In a worst-case     scenario, this weakens transport security     significantly.(CVE-2021-22897)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
203839	Photon OS 3.0: Cmake PHSA-2023-3.0-0603	Nessus	PhotonOS Local Security Checks	critical
203662	Photon OS 4.0: Curl PHSA-2021-4.0-0054	Nessus	PhotonOS Local Security Checks	medium
194928	Splunk Enterprise 8.2.0 < 8.2.12, 9.0.0 < 9.0.6, 9.1.0 < 9.1.1 (SVD-2023-0808)	Nessus	CGI abuses	critical
194927	Universal Forwarders < 8.1.14, 8.2.0 < 8.2.11, 9.0.0 < 9.0.5 (SVD-2023-0614)	Nessus	CGI abuses	critical
194926	Universal Forwarder 8.2.0 < 8.2.12, 9.0.0 < 9.0.6, 9.1.0 < 9.1.1 (SVD-2023-0809)	Nessus	CGI abuses	critical
194919	Splunk Enterprise < 8.1.14, 8.2.0 < 8.2.11, 9.0.0 < 9.0.5 (SVD-2023-0613)	Nessus	CGI abuses	critical
184151	Puppet Agent 6.x < 6.23.0 / 7.x < 7.8.0 Multiple Vulnerabilities	Nessus	Windows	high
184149	Puppet Enterprise < 2019.8.7 / 2021.x < 2021.2 Curl Vulnerabilities	Nessus	Misc.	high
172939	CBL Mariner 2.0 Security Update: curl (CVE-2021-22897)	Nessus	MarinerOS Local Security Checks	medium
157964	EulerOS Virtualization 3.0.6.0 : curl (EulerOS-SA-2022-1062)	Nessus	Huawei Local Security Checks	medium
156677	Juniper Junos OS Multiple Vulnerabilities (JSA11289)	Nessus	Junos Local Security Checks	high
152337	EulerOS 2.0 SP9 : curl (EulerOS-SA-2021-2265)	Nessus	Huawei Local Security Checks	medium
152334	EulerOS 2.0 SP9 : curl (EulerOS-SA-2021-2239)	Nessus	Huawei Local Security Checks	medium
152278	EulerOS 2.0 SP8 : curl (EulerOS-SA-2021-2290)	Nessus	Huawei Local Security Checks	medium
151542	EulerOS Virtualization 2.9.0 : curl (EulerOS-SA-2021-2206)	Nessus	Huawei Local Security Checks	medium
151537	EulerOS Virtualization 2.9.1 : curl (EulerOS-SA-2021-2176)	Nessus	Huawei Local Security Checks	medium
151435	Photon OS 2.0: Curl PHSA-2021-2.0-0366	Nessus	PhotonOS Local Security Checks	medium

Detections

Analytics

CVE-2021-22897

medium

Tenable Plugins

critical

medium

critical

critical

critical

critical

high

high

medium

medium

high

medium

medium

medium

medium

medium

medium