The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For example, a URL like `http://example.com%2F127.0.0.1/`, would be allowed bythe parser and get transposed into `http://example.com/127.0.0.1/`. This flawcan be used to circumvent filters, checks and more.

An update of the curl package has been released.

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2023-0808 advisory.

  - The go command may execute arbitrary code at build time when using cgo. This may occur when running go     get on a malicious module, or when running any other command which builds untrusted code. This is can by     triggered by linker flags, specified via a #cgo LDFLAGS directive. Flags containing embedded spaces are     mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in     the argument of another flag. This only affects usage of the gccgo compiler. (CVE-2023-29405)

  - When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by     finalizing the operation with a rename from a temporary name to the final target file name.In that rename     operation, it might accidentally *widen* the permissions for the target file, leaving the updated file     accessible to more users than intended. (CVE-2022-32207)

  - decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS. (CVE-2022-38900)

  - The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.
    (CVE-2022-33987)

  - Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the     name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3. (CVE-2022-37601)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2023-0613 advisory.

  - A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as     @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states we are in     the process of marking this report as invalid; however, some third parties takes the position that A     prototype injection/Prototype pollution is not just when global objects are polluted with recursive merge     or deep cloning but also when a target object is polluted. (CVE-2022-37616)

  - When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by     finalizing the operation with a rename from a temporary name to the final target file name.In that rename     operation, it might accidentally *widen* the permissions for the target file, leaving the updated file     accessible to more users than intended. (CVE-2022-32207)

  - An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the     XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to     access an array at a negative 2GB offset, typically leading to a segmentation fault. (CVE-2022-40303)

  - An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a     hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be     provoked. (CVE-2022-40304)

  - There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName.
    X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME     incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently     interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL     checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may     allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or     enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate     chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these     inputs, the other input must already contain an X.400 address as a CRL distribution point, which is     uncommon. As such, this vulnerability is most likely to only affect applications which have implemented     their own functionality for retrieving CRLs over a network. (CVE-2023-0286)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-083 advisory.

    2024-02-15: CVE-2022-27781 was added to this advisory.

    A vulnerability was found in curl. This security flaw allows reusing OAUTH2-authenticated connections     without properly ensuring that the connection was authenticated with the same credentials set for this     transfer. This issue leads to an authentication bypass, either by mistake or by a malicious actor.
    (CVE-2022-22576)

    A vulnerability was found in curl. This security flaw allows leaking credentials to other servers when it     follows redirects from auth-protected HTTP(S) URLs to other protocols and port numbers. (CVE-2022-27774)

    A vulnerability was found in curl. This security flaw occurs due to errors in the logic where the config     matching function did not take the IPv6 address zone id into account. This issue can lead to curl reusing     the wrong connection when one transfer uses a zone id, and the subsequent transfer uses another.
    (CVE-2022-27775)

    A vulnerability was found in curl. This security flaw allows leak authentication or cookie header data on     HTTP redirects to the same host but another port number. Sending the same set of headers to a server on a     different port number is a problem for applications that pass on custom `Authorization:` or     `Cookie:`headers. Those headers often contain privacy-sensitive information or data. (CVE-2022-27776)

    A vulnerability was found in curl. The issue occurs because curl wrongly allows HTTP cookies to be set for     Top Level Domains (TLDs) if the hostname is provided with a trailing dot. This flaw allows arbitrary sites     to set cookies that get sent to a different and unrelated site or domain by a malicious actor.
    (CVE-2022-27779)

    A vulnerability was found in curl. This issue occurs because the curl URL parser wrongly accepts percent-     encoded URL separators like / when decoding the hostname part of a URL, making it a different URL using     the wrong hostname when it is later retrieved. This flaw allows a malicious actor to make circumventing     filters. (CVE-2022-27780)

    libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned     about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl     built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation.
    (CVE-2022-27781)

    A vulnerability was found in curl. This issue occurs because curl can reuse a previously created     connection even when a TLS or SSH-related option is changed that should have prohibited reuse. This flaw     leads to an authentication bypass, either by mistake or by a malicious actor. (CVE-2022-27782)

    A vulnerability was found in curl. This issue occurs because when using its HTTP Strict Transport     Security(HSTS) support, it can instruct curl to use HTTPS directly instead of using an insecure clear text     HTTP step even when HTTP is provided in the URL. This flaw leads to a clear text transmission of sensitive     information. (CVE-2022-30115)

    A vulnerability was found in curl. This issue occurs because a malicious server can serve excessive     amounts of `Set-Cookie:` headers in an HTTP response to curl, which stores all of them. This flaw leads to     a denial of service, either by mistake or by a malicious actor. (CVE-2022-32205)

    A vulnerability was found in curl. This issue occurs because the number of acceptable links in the     decompression chain was unbounded, allowing a malicious server to insert a virtually unlimited number of     compression steps. This flaw leads to a denial of service, either by mistake or by a malicious actor.
    (CVE-2022-32206)

    A vulnerability was found in curl. This issue occurs because when curl saves cookies, alt-svc, and HSTS     data to local files, it makes the operation atomic by finalizing the process with a rename from a     temporary name to the final target file name. This flaw leads to unpreserved file permissions, either by     mistake or by a malicious actor. (CVE-2022-32207)

    A vulnerability was found in curl. This issue occurs because it mishandles message verification failures     when curl does FTP transfers secured by krb5. This flaw makes it possible for a Man-in-the-middle attack     to go unnoticed and allows data injection into the client. (CVE-2022-32208)

    A vulnerability was found in curl. The issue occurs when doing HTTP(S) transfers, where curl might     erroneously use the read callback () to ask for data to send, even when the  option has been set if it     previously used the same handle to issue a  request which used that callback. This flaw may surprise the     application and cause it to misbehave and either send off the wrong data or use memory after free or     similar in the subsequent  request. (CVE-2022-32221)

    A vulnerability found in curl. This security flaw happens when curl is used to retrieve and parse cookies     from an HTTP(S) server, where it accepts cookies using control codes (byte values below 32), and also when     cookies that contain such control codes are later sent back to an HTTP(S) server, possibly causing the     server to return a 400 response. This issue effectively allows a sister site to deny service to siblings     and cause a denial of service attack. (CVE-2022-35252)

    A vulnerability was found in curl. The issue occurs when curl is told to parse a `.netrc` file for     credentials. If that file ends in a line with consecutive non-white space letters and no newline, curl     could read past the end of the stack-based buffer, and if the read works, it can write a zero byte beyond     its boundary. This issue, in most cases, causes a segfault or similar problem. A denial of service can     occur if a malicious user can provide a custom netrc file to an application or otherwise affect its     contents. (CVE-2022-35260)

    A vulnerability was found in curl. The issue occurs if curl is told to use an HTTP proxy for a transfer     with a non-HTTP(S) URL. It sets up the connection to the remote server by issuing a `CONNECT` request to     the proxy and then tunnels the rest of the protocol through. An HTTP proxy might refuse this request (HTTP     proxies often only allow outgoing connections to specific port numbers, like 443 for HTTPS) and instead     return a non-200 response code to the client. Due to flaws in the error/cleanup handling, this could     trigger a double-free issue in curl if using one of the following schemes in the URL for the transfer:
    `dict,` `gopher,` `gophers,` `ldap`, `ldaps`, `rtmp`, `rtmps`, `telnet.` (CVE-2022-42915)

    A vulnerability was found in curl. The issue occurs because curl's HSTS check can be bypassed to trick it     to keep using HTTP. Using its HSTS support, it can instruct curl to use HTTPS directly instead of using an     insecure clear-text HTTP step even when HTTP is provided in the URL. This mechanism can be bypassed if the     hostname in the given URL uses IDN characters that get replaced with ASCII counterparts as part of the IDN     conversion. Like using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full     stop (U+002E) . (CVE-2022-42916)

    A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP.
    Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP     step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypassed if the host name     in the given URL first uses IDN characters that get replaced to ASCII counterparts as part of the IDN     conversion. Like using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full     stop (U+002E) `.`. Then in a subsequent request, it does not detect the HSTS state and makes a clear text     transfer. Because it would store the info IDN encoded but look for it IDN decoded. (CVE-2022-43551)

    A vulnerability was found in curl. In this issue, curl can be asked to tunnel all protocols virtually it     supports through an HTTP proxy. HTTP proxies can deny these tunnel operations using an appropriate HTTP     error response code. When getting denied to tunnel the specific SMB or TELNET protocols, curl can use a     heap-allocated struct after it has been freed and shut down the code path in its transfer.
    (CVE-2022-43552)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of IBM Rational ClearCase installed on the remote host is affected by multiple vulnerabilities, including the following:

  - A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when     '--no-clobber' is used together with '--remove-on-error'. (CVE-2022-27778)

  - The curl URL parser wrongly accepts percent-encoded URL separators like '/' when decoding the host name     part of a URL, making it a *different* URL using the wrong host name when it is later retrieved. For     example, a URL like 'http://example.com%2F127.0.0.1/', would be allowed bythe parser and get transposed     into 'http://example.com/127.0.0.1/'. This flaw can be used to circumvent filters, checks and more.
    (CVE-2022-27780)

  - libcurl would reuse a previously created connection even when a TLS or SSH related option had been changed     that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for     subsequent transfers to reuse if one of them matches the setup. However, several TLS and SSH settings were     left out from the configuration match checks, making them match too easily. (CVE-2022-27782)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202212-01 (curl: Multiple Vulnerabilities)

  - When curl is instructed to download content using the metalink feature, thecontents is verified against a     hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same     contentfrom a set of different URLs, potentially hosted by different servers and theclient can then     download the file from one or several of them. In a serial orparallel manner.If one of the servers hosting     the contents has been breached and the contentsof the specific file on that server is replaced with a     modified payload, curlshould detect this when the hash of the file mismatches after a completeddownload.
    It should remove the contents and instead try getting the contentsfrom another URL. This is not done, and     instead such a hash mismatch is onlymentioned in text and the potentially malicious content is kept in the     file ondisk. (CVE-2021-22922)

  - When curl is instructed to get content using the metalink feature, and a user name and password are used     to download the metalink XML file, those same credentials are then subsequently passed on to each of the     servers from which curl will download or try to download the contents from. Often contrary to the user's     expectations and intentions and without telling the user it happened. (CVE-2021-22923)

  - curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used     option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for     sending `NEW_ENV` variables, libcurlcould be made to pass on uninitialized data from a stack based buffer     to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-     text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing     the string provided by the application. (CVE-2021-22925)

  - libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is     done with the `CURLOPT_SSLCERT` option (`--cert` with the command line tool).When libcurl is built to use     the macOS native TLS library Secure Transport, an application can ask for the client certificate by name     or with a file name - using the same option. If the name exists as a file, it will be used instead of by     name.If the appliction runs with a current working directory that is writable by other users (like     `/tmp`), a malicious user can create a file name with the same name as the app wants to use by name, and     thereby trick the application to use the file based cert instead of the one referred to by name making     libcurl send the wrong client certificate in the TLS connection handshake. (CVE-2021-22926)

  - When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously     keep a pointer to an already freed memory area and both use that again in a subsequent call to send data     and also free it *again*. (CVE-2021-22945)

  - A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an     IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL`     or `CURLUSESSL_ALL` withlibcurl). This requirement could be bypassed if the server would return a properly     crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations
    **withoutTLS** contrary to the instructions and expectations, exposing possibly sensitive data in clear     text over the network. (CVE-2021-22946)

  - When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to     upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches.
    curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using     and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw,     it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS     traffic from the legitimate server and trick curl into sending data back to the user thinking the     attacker's injected data comes from the TLS-protected server. (CVE-2021-22947)

  - An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow     reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated     with the same credentials as set for this transfer. This affects SASL-enabled protocols: SMPTP(S),     IMAP(S), POP3(S) and LDAP(S) (openldap only). (CVE-2022-22576)

  - An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are     affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with     authentication could leak credentials to other services that exist on different protocols or port numbers.
    (CVE-2022-27774)

  - An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an     IPv6 address that was in the connection pool but with a different zone id it could reuse a connection     instead. (CVE-2022-27775)

  - A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or     cookie header data on HTTP redirects to the same host but another port number. (CVE-2022-27776)

  - libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a     trailing dot.curl can be told to receive and send cookies. curl's cookie engine can bebuilt with or     without [Public Suffix List](https://publicsuffix.org/)awareness. If PSL support not provided, a more     rudimentary check exists to atleast prevent cookies from being set on TLDs. This check was broken if     thehost name in the URL uses a trailing dot.This can allow arbitrary sites to set cookies that then would     get sent to adifferent and unrelated site or domain. (CVE-2022-27779)

  - The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name     part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For     example, a URL like `http://example.com%2F127.0.0.1/`, would be allowed bythe parser and get transposed     into `http://example.com/127.0.0.1/`. This flawcan be used to circumvent filters, checks and more.
    (CVE-2022-27780)

  - libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned     about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl     built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation.
    (CVE-2022-27781)

  - libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed     that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for     subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were     left out from the configuration match checks, making themmatch too easily. (CVE-2022-27782)

  - Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-     text HTTP step even when HTTP is provided in theURL. This mechanism could be bypassed if the host name in     the given URL used atrailing dot while not using one when it built the HSTS cache. Or the otherway around
    - by having the trailing dot in the HSTS cache and *not* using thetrailing dot in the URL.
    (CVE-2022-30115)

  - A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and     curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP     requests to this, or other servers to which the cookies match, create requests that become larger than the     threshold that curl uses internally to avoid sending crazy large requests (1048576 bytes) and instead     returns an error.This denial state might remain for as long as the same cookies are kept, match and     haven't expired. Due to cookie matching rules, a server on `foo.example.com` can set cookies that also     would match for `bar.example.com`, making it it possible for a sister server to effectively cause a     denial of service for a sibling site on the same second level domain using this method. (CVE-2022-32205)

  - curl < 7.84.0 supports chained HTTP compression algorithms, meaning that a serverresponse can be     compressed multiple times and potentially with different algorithms. The number of acceptable links in     this decompression chain was unbounded, allowing a malicious server to insert a virtually unlimited     number of compression steps.The use of such a decompression chain could result in a malloc bomb,     makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of     memory errors. (CVE-2022-32206)

  - When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by     finalizing the operation with a rename from a temporary name to the final target file name.In that rename     operation, it might accidentally *widen* the permissions for the target file, leaving the updated file     accessible to more users than intended. (CVE-2022-32207)

  - When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly.
    This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject     data to the client. (CVE-2022-32208)

  - When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to     ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle     previously was used to issue a `PUT` request which used that callback. This flaw may surprise the     application and cause it to misbehave and either send off the wrong data or use memory after free or     similar in the subsequent `POST` request. The problem exists in the logic for a reused handle when it is     changed from a PUT to a POST. (CVE-2022-32221)

  - When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control     codes that when later are sent back to a HTTPserver might make the server return 400 responses.
    Effectively allowing asister site to deny service to all siblings. (CVE-2022-35252)

  - curl can be told to parse a `.netrc` file for credentials. If that file endsin a line with 4095     consecutive non-white space letters and no newline, curlwould first read past the end of the stack-based     buffer, and if the readworks, write a zero byte beyond its boundary.This will in most cases cause a     segfault or similar, but circumstances might also cause different outcomes.If a malicious user can provide     a custom netrc file to an application or otherwise affect its contents, this flaw could be used as denial-     of-service. (CVE-2022-35260)

  - curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-     HTTP(S) URL, it sets up the connection to the remote server by issuing a CONNECT request to the proxy, and     then tunnels the rest of the protocol through. An HTTP proxy might refuse this request (HTTP proxies often     only allow outgoing connections to specific port numbers, like 443 for HTTPS) and instead return a non-200     status code to the client. Due to flaws in the error/cleanup handling, this could trigger a double free in     curl if one of the following schemes were used in the URL for the transfer: dict, gopher, gophers, ldap,     ldaps, rtmp, rtmps, or telnet. The earliest affected version is 7.77.0. (CVE-2022-42915)

  - In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS     support, curl can be instructed to use HTTPS directly (instead of using an insecure cleartext HTTP step)     even when HTTP is provided in the URL. This mechanism could be bypassed if the host name in the given URL     uses IDN characters that get replaced with ASCII counterparts as part of the IDN conversion, e.g., using     the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop of U+002E (.).
    The earliest affected version is 7.77.0 2021-05-26. (CVE-2022-42916)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-206 advisory.

    A vulnerability was found in curl. This issue occurs because a malicious server can serve excessive     amounts of `Set-Cookie:` headers in an HTTP response to curl, which stores all of them. This flaw leads to     a denial of service, either by mistake or by a malicious actor. (CVE-2022-32205)

    A vulnerability was found in curl. This issue occurs because the number of acceptable links in the     decompression chain was unbounded, allowing a malicious server to insert a virtually unlimited number of     compression steps. This flaw leads to a denial of service, either by mistake or by a malicious actor.
    (CVE-2022-32206)

    A vulnerability was found in curl. This issue occurs because when curl saves cookies, alt-svc, and HSTS     data to local files, it makes the operation atomic by finalizing the process with a rename from a     temporary name to the final target file name. This flaw leads to unpreserved file permissions, either by     mistake or by a malicious actor. (CVE-2022-32207)

    A vulnerability was found in curl. This issue occurs because it mishandles message verification failures     when curl does FTP transfers secured by krb5. This flaw makes it possible for a Man-in-the-middle attack     to go unnoticed and allows data injection into the client. (CVE-2022-32208)

    A vulnerability found in curl. This security flaw happens when curl is used to retrieve and parse cookies     from an HTTP(S) server, where it accepts cookies using control codes (byte values below 32), and also when     cookies that contain such control codes are later sent back to an HTTP(S) server, possibly causing the     server to return a 400 response. This issue effectively allows a sister site to deny service to siblings     and cause a denial of service attack. (CVE-2022-35252)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-065 advisory.

    A vulnerability was found in curl. This security flaw allows reusing OAUTH2-authenticated connections     without properly ensuring that the connection was authenticated with the same credentials set for this     transfer. This issue leads to an authentication bypass, either by mistake or by a malicious actor.
    (CVE-2022-22576)

    A vulnerability was found in curl. This security flaw allows leaking credentials to other servers when it     follows redirects from auth-protected HTTP(S) URLs to other protocols and port numbers. (CVE-2022-27774)

    A vulnerability was found in curl. This security flaw occurs due to errors in the logic where the config     matching function did not take the IPv6 address zone id into account. This issue can lead to curl reusing     the wrong connection when one transfer uses a zone id, and the subsequent transfer uses another.
    (CVE-2022-27775)

    A vulnerability was found in curl. This security flaw allows leak authentication or cookie header data on     HTTP redirects to the same host but another port number. Sending the same set of headers to a server on a     different port number is a problem for applications that pass on custom `Authorization:` or     `Cookie:`headers. Those headers often contain privacy-sensitive information or data. (CVE-2022-27776)

    A vulnerability was found in curl. The issue occurs because curl wrongly allows HTTP cookies to be set for     Top Level Domains (TLDs) if the hostname is provided with a trailing dot. This flaw allows arbitrary sites     to set cookies that get sent to a different and unrelated site or domain by a malicious actor.
    (CVE-2022-27779)

    A vulnerability was found in curl. This issue occurs because the curl URL parser wrongly accepts percent-     encoded URL separators like / when decoding the hostname part of a URL, making it a different URL using     the wrong hostname when it is later retrieved. This flaw allows a malicious actor to make circumventing     filters. (CVE-2022-27780)

    A vulnerability was found in curl. This issue occurs because curl can reuse a previously created     connection even when a TLS or SSH-related option is changed that should have prohibited reuse. This flaw     leads to an authentication bypass, either by mistake or by a malicious actor. (CVE-2022-27782)

    A vulnerability was found in curl. This issue occurs because when using its HTTP Strict Transport     Security(HSTS) support, it can instruct curl to use HTTPS directly instead of using an insecure clear text     HTTP step even when HTTP is provided in the URL. This flaw leads to a clear text transmission of sensitive     information. (CVE-2022-30115)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 11e36890-d28c-11ec-a06f-d4c9ef517024 advisory.

  - Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-     text HTTP step even when HTTP is provided in theURL. This mechanism could be bypassed if the host name in     the given URL used atrailing dot while not using one when it built the HSTS cache. Or the otherway around
    - by having the trailing dot in the HSTS cache and *not* using thetrailing dot in the URL.
    (CVE-2022-30115)

  - A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-     clobber` is used together with `--remove-on-error`. (CVE-2022-27778)

  - libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a     trailing dot.curl can be told to receive and send cookies. curl's cookie engine can bebuilt with or     without [Public Suffix List](https://publicsuffix.org/)awareness. If PSL support not provided, a more     rudimentary check exists to atleast prevent cookies from being set on TLDs. This check was broken if     thehost name in the URL uses a trailing dot.This can allow arbitrary sites to set cookies that then would     get sent to adifferent and unrelated site or domain. (CVE-2022-27779)

  - The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name     part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For     example, a URL like `http://example.com%2F127.0.0.1/`, would be allowed bythe parser and get transposed     into `http://example.com/127.0.0.1/`. This flawcan be used to circumvent filters, checks and more.
    (CVE-2022-27780)

  - libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned     about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl     built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation.
    (CVE-2022-27781)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-d15a736748 advisory.

    - fix too eager reuse of TLS and SSH connections (CVE-2022-27782)
    - do not accept cookies for TLD with trailing dot (CVE-2022-27779)
    - hsts: ignore trailing dots when comparing hosts names (CVE-2022-30115)
    - reject percent-encoded path separator in URL host (CVE-2022-27780)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5412-1 advisory.

    Axel Chong discovered that curl incorrectly handled percent-encoded URL separators. A remote attacker     could possibly use this issue to trick curl into using the wrong URL and bypass certain checks or filters.
    This issue only affected Ubuntu 22.04 LTS. (CVE-2022-27780)

    Florian Kohnhuser discovered that curl incorrectly handled returning a TLS server's certificate chain     details. A remote attacker could possibly use this issue to cause curl to stop responding, resulting in a     denial of service. (CVE-2022-27781)

    Harry Sintonen discovered that curl incorrectly reused a previous connection when certain options had been     changed, contrary to expectations. (CVE-2022-27782)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of curl installed on the remote host is prior to 7.83.1. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2022-131-01 advisory.

  - libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed     that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for     subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were     left out from the configuration match checks, making themmatch too easily. (CVE-2022-27782)

  - A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-     clobber` is used together with `--remove-on-error`. (CVE-2022-27778)

  - libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a     trailing dot.curl can be told to receive and send cookies. curl's cookie engine can bebuilt with or     without [Public Suffix List](https://publicsuffix.org/)awareness. If PSL support not provided, a more     rudimentary check exists to atleast prevent cookies from being set on TLDs. This check was broken if     thehost name in the URL uses a trailing dot.This can allow arbitrary sites to set cookies that then would     get sent to adifferent and unrelated site or domain. (CVE-2022-27779)

  - The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name     part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For     example, a URL like `http://example.com%2F127.0.0.1/`, would be allowed bythe parser and get transposed     into `http://example.com/127.0.0.1/`. This flawcan be used to circumvent filters, checks and more.
    (CVE-2022-27780)

  - libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned     about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl     built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation.
    (CVE-2022-27781)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
203950	Photon OS 3.0: Curl PHSA-2022-3.0-0406	Nessus	PhotonOS Local Security Checks	high
203221	Photon OS 4.0: Curl PHSA-2022-4.0-0205	Nessus	PhotonOS Local Security Checks	high
194928	Splunk Enterprise 8.2.0 < 8.2.12, 9.0.0 < 9.0.6, 9.1.0 < 9.1.1 (SVD-2023-0808)	Nessus	CGI abuses	critical
194927	Universal Forwarders < 8.1.14, 8.2.0 < 8.2.11, 9.0.0 < 9.0.5 (SVD-2023-0614)	Nessus	CGI abuses	critical
194926	Universal Forwarder 8.2.0 < 8.2.12, 9.0.0 < 9.0.6, 9.1.0 < 9.1.1 (SVD-2023-0809)	Nessus	CGI abuses	critical
194919	Splunk Enterprise < 8.1.14, 8.2.0 < 8.2.11, 9.0.0 < 9.0.5 (SVD-2023-0613)	Nessus	CGI abuses	critical
173171	Amazon Linux 2023 : curl, curl-minimal, libcurl (ALAS2023-2023-083)	Nessus	Amazon Linux Local Security Checks	critical
172123	IBM Rational ClearCase 8.0 < 9.0.1.14 / 9.0.2 < 9.0.2.6 / 9.1 < 9.1.0.3 Multiple Vulnerabilities	Nessus	Windows	high
168911	GLSA-202212-01 : curl: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
167007	Amazon Linux 2022 : curl, curl-minimal, libcurl (ALAS2022-2022-206)	Nessus	Amazon Linux Local Security Checks	critical
164745	Amazon Linux 2022 : curl, curl-minimal, libcurl (ALAS2022-2022-065)	Nessus	Amazon Linux Local Security Checks	high
161169	FreeBSD : curl -- Multiple vulnerabilities (11e36890-d28c-11ec-a06f-d4c9ef517024)	Nessus	FreeBSD Local Security Checks	high
161149	Fedora 36 : curl (2022-d15a736748)	Nessus	Fedora Local Security Checks	high
161058	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : curl vulnerabilities (USN-5412-1)	Nessus	Ubuntu Local Security Checks	high
161057	Slackware Linux 14.0 / 14.1 / 14.2 / 15.0 / current curl Multiple Vulnerabilities (SSA:2022-131-01)	Nessus	Slackware Local Security Checks	high

Detections

Analytics

CVE-2022-27780

high

Tenable Plugins

high

high

critical

critical

critical

critical

critical

high

critical

critical

high

high

high

high

high