When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use.

The remote host is affected by the vulnerability described in GLSA-202409-20 (curl: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in curl. Please review the CVE identifiers referenced below     for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of cmake / curl / mysql installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-46219 advisory.

  - When saving HSTS data to an excessively long file name, curl could end up removing all contents, making     subsequent requests using that file unaware of the HSTS status they should otherwise use. (CVE-2023-46219)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the curl package has been released.

The version of Tenable.ad installed on the remote host is prior to 3.59.5. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2024-11 advisory.

  - The POLY1305 MAC (message authentication code) implementation contains a bug that might     corrupt the internal state of applications on the Windows 64 platform when running on newer X86_64     processors supporting the AVX512-IFMA instructions. Impact summary: If in an application that uses the     OpenSSL library an attacker can influence whether the POLY1305 MAC algorithm is used, the application     state might be corrupted with various application dependent consequences. The POLY1305 MAC (message     authentication code) implementation in OpenSSL does not save the contents of non-volatile XMM registers on     Windows 64 platform when calculating the MAC of data larger than 64 bytes. Before returning to the caller     all the XMM registers are set to zero rather than restoring their previous content. The vulnerable code is     used only on newer x86_64 processors supporting the AVX512-IFMA instructions. The consequences of this     kind of internal application state corruption can be various - from no consequences, if the calling     application does not depend on the contents of non-volatile XMM registers at all, to the worst     consequences, where the attacker could get complete control of the application process. However given the     contents of the registers are just zeroized so the attacker cannot put arbitrary values inside, the most     likely consequence, if any, would be an incorrect result of some application dependent calculations or a     crash leading to a denial of service. The POLY1305 MAC algorithm is most frequently used as part of the     CHACHA20-POLY1305 AEAD (authenticated encryption with associated data) algorithm. The most common usage of     this AEAD cipher is with TLS protocol versions 1.2 and 1.3 and a malicious client can influence whether     this AEAD cipher is used by the server. This implies that server applications using OpenSSL can be     potentially impacted. However we are currently not aware of any concrete application that would be     affected by this issue therefore we consider this a Low severity security issue. As a workaround the     AVX512-IFMA instructions support can be disabled at runtime by setting the environment variable     OPENSSL_ia32cap: OPENSSL_ia32cap=:~0x200000 The FIPS provider is not affected by this issue.
    (CVE-2023-4807)

  - Envoy is a cloud-native, open source edge and service proxy. Envoyproxy with a Brotli filter can get into     an endless loop during decompression of Brotli data with extra input. (CVE-2024-32976)

  - Envoy is a cloud-native, open source edge and service proxy. Envoy exposed an out-of-memory (OOM) vector     from the mirror response, since async HTTP client will buffer the response with an unbounded buffer.
    (CVE-2024-34364)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    When saving HSTS data to an excessively long file name, curl could end up removing all contents, making     subsequent requests using that file unaware of the HSTS status they should otherwise use.(CVE-2023-46219)

Tenable has extracted the preceding description block directly from the EulerOS curl security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - When saving HSTS data to an excessively long file name, curl could end up removing all contents, making     subsequent requests using that file unaware of the HSTS status they should otherwise use. (CVE-2023-46219)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2024-0304 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.4.0. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2024-07 advisory.

  - Nessus Network Monitor leverages third-party software to help provide underlying functionality. Several of     the third-party components (hyperscan, curl and c-ares)were found to contain vulnerabilities, and     updated versions have been made available by the providers.Out of caution and in line with best practice,     Tenable has opted to upgrade these components to address the potential impact of the issues. Nessus     Network Monitor 6.4.0 updates hyperscan to version 5.4.2, curl to version 8.6.0, and c-ares to version     1.28.0. Tenable has released Nessus Network Monitor 6.4.0 to address these issues. The installation files     can be obtained from the Tenable Downloads Portal (https://www.tenable.com/downloads/nessus-network-     monitor). (CVE-2023-28711, CVE-2023-46218, CVE-2023-46219, CVE-2024-25629)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - This flaw allows a malicious HTTP server to set 'super cookies' in curl that are then passed back to more     origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get     sent to different and unrelated sites and domains. It could do this by exploiting a mixed case flaw in     curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a     cookie could be set with `domain=co.UK` when the URL used a lower case hostname `curl.co.uk`, even though     `co.uk` is listed as a PSL domain. (CVE-2023-46218)

  - When saving HSTS data to an excessively long file name, curl could end up removing all contents, making     subsequent requests using that file unaware of the HSTS status they should otherwise use. (CVE-2023-46219)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1316 advisory.

    Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This     software, such as Apache HTTP Server, is common to multiple JBoss middleware products and packaged under     Red Hat JBoss Core Services, to allow for faster distribution of updates and for a more consistent update     experience.

    This release of Red Hat JBoss Core Services Apache HTTP Server 2.4.57 Service Pack 3 serves as a     replacement for Red Hat JBoss Core Services Apache HTTP Server 2.4.57 Service Pack 2, and includes bug     fixes and enhancements, which are documented in the Release Notes linked to in the References section.

    Security Fix(es):

    * curl: information disclosure by exploiting a mixed case flaw (CVE-2023-46218)
    * curl: excessively long file name may lead to unknown HSTS status (CVE-2023-46219)
    * httpd: mod_macro: out-of-bounds read vulnerability (CVE-2023-31122)
    * jbcs-httpd24-mod_proxy_cluster: mod_cluster/mod_proxy_cluster: Stored Cross site Scripting     (CVE-2023-6710)
    * jbcs-httpd24-openssl: openssl: Generating excessively long X9.42 DH keys or checking excessively long     X9.42 DH keys or parameters may be very slow (CVE-2023-5678)

    A Red Hat Security Bulletin which addresses further details about this flaw is available in the References     section.

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - This flaw allows a malicious HTTP server to set 'super cookies' in curl that are then passed back to more     origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get     sent to different and unrelated sites and domains. It could do this by exploiting a mixed case flaw in     curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a     cookie could be set with `domain=co.UK` when the URL used a lower case hostname `curl.co.uk`, even though     `co.uk` is listed as a PSL domain. (CVE-2023-46218)

  - When saving HSTS data to an excessively long file name, curl could end up removing all contents, making     subsequent requests using that file unaware of the HSTS status they should otherwise use. (CVE-2023-46219)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - When saving HSTS data to an excessively long file name, curl could end up removing all contents, making     subsequent requests using that file unaware of the HSTS status they should otherwise use. (CVE-2023-46219)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of curl installed on the remote host is prior to 8.3.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2385 advisory.

    This flaw allows a malicious HTTP server to set super cookies in curl that are then passed back to more     origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get     sent to different and unrelated sites and domains.

    It could do this by exploiting a mixed case flaw in curl's function that verifies a given cookie domain     against the Public Suffix List (PSL). For example a cookie could be set with domain=co.UK when the URL     used a lowercase hostname curl.co.uk, even though co.uk is listed as a PSL domain. (CVE-2023-46218)

    When saving HSTS data to an excessively long file name, curl could end up removing all contents, making     subsequent requests using that file unaware of the HSTS status they should otherwise use. (CVE-2023-46219)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Curl installed on the remote host is between 7.84.0 and 8.4.0. It is, therefore, affected by an information disclosure vulnerability. When saving HSTS data to an excessively long file name, Curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-472 advisory.

    This flaw allows a malicious HTTP server to set super cookies in curl that are then passed back to more     origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get     sent to different and unrelated sites and domains.

    It could do this by exploiting a mixed case flaw in curl's function that verifies a given cookie domain     against the Public Suffix List (PSL). For example a cookie could be set with domain=co.UK when the URL     used a lowercase hostname curl.co.uk, even though co.uk is listed as a PSL domain. (CVE-2023-46218)

    When saving HSTS data to an excessively long file name, curl could end up removing all contents, making     subsequent requests using that file unaware of the HSTS status they should otherwise use. (CVE-2023-46219)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5587 advisory.

  - This flaw allows a malicious HTTP server to set super cookies in curl that are then passed back to more     origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get     sent to different and unrelated sites and domains. It could do this by exploiting a mixed case flaw in     curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a     cookie could be set with `domain=co.UK` when the URL used a lower case hostname `curl.co.uk`, even though     `co.uk` is listed as a PSL domain. (CVE-2023-46218)

  - When saving HSTS data to an excessively long file name, curl could end up removing all contents, making     subsequent requests using that file unaware of the HSTS status they should otherwise use. (CVE-2023-46219)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-2121eca964 advisory.

    - fix HSTS long file name clears contents (CVE-2023-46219)
    - fix cookie mixed case PSL bypass (CVE-2023-46218)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-9de8973300 advisory.

    - fix HSTS long file name clears contents (CVE-2023-46219)
    - fix cookie mixed case PSL bypass (CVE-2023-46218)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4659-1 advisory.

  - This flaw allows a malicious HTTP server to set super cookies in curl that are then passed back to more     origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get     sent to different and unrelated sites and domains. It could do this by exploiting a mixed case flaw in     curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a     cookie could be set with `domain=co.UK` when the URL used a lower case hostname `curl.co.uk`, even though     `co.uk` is listed as a PSL domain. (CVE-2023-46218)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6535-1 advisory.

    Harry Sintonen discovered that curl incorrectly handled mixed case cookie domains. A remote attacker could     possibly use this issue to set cookies that get sent to different and unrelated sites and domains.
    (CVE-2023-46218)

    Maksymilian Arciemowicz discovered that curl incorrectly handled long file names when saving HSTS data.
    This could result in curl losing HSTS data, and subsequent requests to a site would be done without it,     contrary to expectations. This issue only affected Ubuntu 23.04 and Ubuntu 23.10. (CVE-2023-46219)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
207580	GLSA-202409-20 : curl: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
206357	CBL Mariner 2.0 Security Update: cmake / curl / mysql (CVE-2023-46219)	Nessus	MarinerOS Local Security Checks	medium
204580	Photon OS 5.0: Curl PHSA-2024-5.0-0280	Nessus	PhotonOS Local Security Checks	medium
204195	Photon OS 4.0: Curl PHSA-2024-4.0-0623	Nessus	PhotonOS Local Security Checks	medium
201946	Tenable.ad < 3.59.5 Multiple Vulnerabilities (TNS-2024-11)	Nessus	Misc.	high
198202	EulerOS 2.0 SP12 : curl (EulerOS-SA-2024-1737)	Nessus	Huawei Local Security Checks	medium
198194	EulerOS 2.0 SP12 : curl (EulerOS-SA-2024-1760)	Nessus	Huawei Local Security Checks	medium
197130	EulerOS Virtualization 2.11.0 : curl (EulerOS-SA-2024-1625)	Nessus	Huawei Local Security Checks	medium
197128	EulerOS Virtualization 2.11.1 : curl (EulerOS-SA-2024-1606)	Nessus	Huawei Local Security Checks	medium
194921	Splunk Universal Forwarder 9.0.0 < 9.0.9, 9.1.0 < 9.1.4, 9.2.0 < 9.2.1 (SVD-2024-0304)	Nessus	CGI abuses	critical
194747	Nessus Network Monitor < 6.4.0 Multiple Vulnerabilities (TNS-2024-07)	Nessus	Misc.	medium
193631	EulerOS Virtualization 2.10.1 : curl (EulerOS-SA-2024-1543)	Nessus	Huawei Local Security Checks	medium
193611	EulerOS Virtualization 2.10.0 : curl (EulerOS-SA-2024-1524)	Nessus	Huawei Local Security Checks	medium
192200	RHEL 7 / 8 : Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP3 (RHSA-2024:1316)	Nessus	Red Hat Local Security Checks	critical
191992	EulerOS 2.0 SP10 : curl (EulerOS-SA-2024-1332)	Nessus	Huawei Local Security Checks	medium
191987	EulerOS 2.0 SP10 : curl (EulerOS-SA-2024-1310)	Nessus	Huawei Local Security Checks	medium
191842	EulerOS 2.0 SP11 : curl (EulerOS-SA-2024-1211)	Nessus	Huawei Local Security Checks	medium
191799	EulerOS 2.0 SP11 : curl (EulerOS-SA-2024-1233)	Nessus	Huawei Local Security Checks	medium
187844	Amazon Linux 2 : curl (ALAS-2024-2385)	Nessus	Amazon Linux Local Security Checks	critical
187726	Curl 7.84.0 <= 8.4.0 Information Disclosure (CVE-2023-46219)	Nessus	Misc.	medium
187695	Amazon Linux 2023 : curl, curl-minimal, libcurl (ALAS2023-2024-472)	Nessus	Amazon Linux Local Security Checks	critical
187288	Debian DSA-5587-1 : curl - security update	Nessus	Debian Local Security Checks	medium
186932	Fedora 38 : curl (2023-2121eca964)	Nessus	Fedora Local Security Checks	critical
186705	Fedora 39 : curl (2023-9de8973300)	Nessus	Fedora Local Security Checks	critical
186639	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : curl (SUSE-SU-2023:4659-1)	Nessus	SuSE Local Security Checks	medium
186615	Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 : curl vulnerabilities (USN-6535-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2023-46219

medium

Tenable Plugins

critical

medium

medium

medium

high

medium

medium

medium

medium

critical

medium

medium

medium

critical

medium

medium

medium

medium

critical

medium

critical

medium

critical

critical

medium

critical