GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at the end of header names are ignored, i.e., a "Transfer-Encoding\0: chunked" header is treated the same as a "Transfer-Encoding: chunked" header.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:4365-1 advisory.

    - CVE-2024-52530: Fixed HTTP request smuggling via stripping null bytes from the ends of header names     (bsc#1233285)
    - CVE-2024-52531: Fixed buffer overflow via UTF-8 conversion in soup_header_parse_param_list_strict     (bsc#1233292)
    - CVE-2024-52532: Fixed infinite loop while reading websocket data (bsc#1233287)

    Other fixes:
    - websocket-test: disconnect error copy after       the test ends (glgo#GNOME/libsoup#391).
    - fix an intermittent test failure       (glgo#GNOME/soup#399).
    - updated to version 2.68.4.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:4349-1 advisory.

    - CVE-2024-52530: Fixed HTTP request smuggling via stripping null bytes from the ends of header names     (bsc#1233285)
     - CVE-2024-52531: Fixed buffer overflow via UTF-8 conversion in soup_header_parse_param_list_strict     (bsc#1233292)
     - CVE-2024-52532: Fixed infinite loop while reading websocket data (bsc#1233287)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:4355-1 advisory.

    - CVE-2024-52530: Fixed HTTP request smuggling via stripping null bytes from the ends of header names     (bsc#1233285)
    - CVE-2024-52531: Fixed buffer overflow via UTF-8 conversion in soup_header_parse_param_list_strict     (bsc#1233292)
    - CVE-2024-52532: Fixed infinite loop while reading websocket data (bsc#1233287)

    Other fixes:
    - websocket-test: disconnect error copy after the test ends (glgo#GNOME/libsoup#391).
    - fix an intermittent test failure (glgo#GNOME/soup#399).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:4352-1 advisory.

    - CVE-2024-52530: Fixed HTTP request smuggling via stripping null bytes from the ends of header names     (bsc#1233285)
    - CVE-2024-52531: Fixed buffer overflow via UTF-8 conversion in soup_header_parse_param_list_strict     (bsc#1233292)
    - CVE-2024-52532: Fixed infinite loop while reading websocket data (bsc#1233287)

    Other fixes:

    - websocket-test: disconnect error copy after       the test ends (glgo#GNOME/libsoup#391).
    - fix an intermittent test failure       (glgo#GNOME/soup#399).
    - Increase test timeout on s390x. The http2-body-stream test can be       slow and sometimes times out in our builds.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:4290-1 advisory.

    - CVE-2024-52530: Fixed HTTP request smuggling via stripping null bytes from the ends of header names     (bsc#1233285)
      - CVE-2024-52531: Fixed buffer overflow via UTF-8 conversion in soup_header_parse_param_list_strict     (bsc#1233292)
      - CVE-2024-52532: Fixed infinite loop while reading websocket data (bsc#1233287)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3992 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3992-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                         Sean Whitton     December 12, 2024                             https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : libsoup2.4     Version        : 2.72.0-2+deb11u1     CVE ID         : CVE-2024-52530 CVE-2024-52531 CVE-2024-52532     Debian Bug     : 1088812 1089238 1089240

    Multiple vulnerabilities were discovered in libsoup2.4, an HTTP library     for Gtk+ programs.

    CVE-2024-52530

        In some configurations, HTTP request smuggling is possible because         null characters at the end of the names of HTTP headers were         ignored.

    CVE-2024-52531

        There was a buffer overflow in applications that perform conversion         to UTF-8 in soup_header_parse_param_list_strict.  This could lead to         memory corruption, crashes or information disclosure.
        (Contrary to the CVE description, it is now believed that input         received over the network could trigger this.)

    CVE-2024-52532

        An infinite loop in the processing of WebSocket data from clients         could lead to a denial-of-service problem through memory exhaustion.

    For Debian 11 bullseye, these problems have been fixed in version     2.72.0-2+deb11u1.

    We recommend that you upgrade your libsoup2.4 packages.

    For the detailed security status of libsoup2.4 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libsoup2.4

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-772 advisory.

    GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at     the end of header names are ignored, i.e., a Transfer-Encoding\0: chunked header is treated the same as     a Transfer-Encoding: chunked header. (CVE-2024-52530)

    GNOME libsoup before 3.6.1 allows a buffer overflow in applications that perform conversion to UTF-8 in     soup_header_parse_param_list_strict. Input received over the network cannot trigger this. (CVE-2024-52531)

    GNOME libsoup before 3.6.1 has an infinite loop, and memory consumption. during the reading of certain     patterns of WebSocket data from clients. (CVE-2024-52532)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-9654 advisory.

    [2.62.2-2.0.1]
    - Fixed CVE-2024-52530 for smuggling nullbytes in header names [Orabug: 37289659]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-bd09057dd2 advisory.

    Add patches to fix:

    * CVE-2024-52530 libsoup3: HTTP request smuggling via stripping null bytes from the ends of header names     (bug #2325358)
    * CVE-2024-52532 libsoup3: infinite loop while reading websocket data (bug #2325356)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-af077c1f85 advisory.

    Backport fixes for CVE-2024-52530 and CVE-2024-52532.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7126-1 advisory.

    It was discovered that libsoup ignored certain characters at the end of header names. A remote attacker     could possibly use this issue to perform a HTTP request smuggling attack. (CVE-2024-52530)

    It was discovered that libsoup did not correctly handle memory while performing UTF-8 conversions. An     attacker could possibly use this issue to cause a denial of service or execute arbitrary code.
    (CVE-2024-52531)

    It was discovered that libsoup could enter an infinite loop when reading certain websocket data. An     attacker could possibly use this issue to cause a denial of service. (CVE-2024-52532)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7127-1 advisory.

    It was discovered that libsoup ignored certain characters at the end of header names. A remote attacker     could possibly use this issue to perform a HTTP request smuggling attack. This issue only affected Ubuntu     22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-52530)

    It was discovered that libsoup did not correctly handle memory while performing UTF-8 conversions. An     attacker could possibly use this issue to cause a denial of service or execute arbitrary code.
    (CVE-2024-52531)

    It was discovered that libsoup could enter an infinite loop when reading certain websocket data. An     attacker could possibly use this issue to cause a denial of service. (CVE-2024-52532)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-8c3476dd24 advisory.

    Backport fixes for CVE-2024-52530 and CVE-2024-52532.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-a059ea1dfc advisory.

    Add patches to fix:

    * CVE-2024-52530 libsoup3: HTTP request smuggling via stripping null bytes from the ends of header names     (bug #2325358)
    * CVE-2024-52532 libsoup3: infinite loop while reading websocket data (bug #2325356)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of libsoup installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-52530 advisory.

  - GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at     the end of header names are ignored, i.e., a Transfer-Encoding\0: chunked header is treated the same as     a Transfer-Encoding: chunked header. (CVE-2024-52530)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:9654 advisory.

    The libsoup packages provide an HTTP client and server library for GNOME.

    Security Fix(es):

    * libsoup: HTTP request smuggling via stripping null bytes from the ends of header names (CVE-2024-52530)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-9559 advisory.

    - Backport upstream patch for CVE-2024-52532 - infinite loop while reading websocket data
    - Backport upstream patch for CVE-2024-52530 - HTTP request smuggling via stripping null bytes from the     ends of header names

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:9573 advisory.

    * libsoup: infinite loop while reading websocket data (CVE-2024-52532)

    * libsoup: HTTP request smuggling via stripping null bytes from the ends of header names (CVE-2024-52530)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-9573 advisory.

    - Backport upstream patch for CVE-2024-52530 - HTTP request smuggling via stripping null bytes from the     ends of header names
    - Backport upstream patch for CVE-2024-52530 - infinite loop while reading websocket data

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:9573 advisory.

    The libsoup packages provide an HTTP client and server library for GNOME.

    Security Fix(es):

    * libsoup: infinite loop while reading websocket data (CVE-2024-52532)

    * libsoup: HTTP request smuggling via stripping null bytes from the ends of header names (CVE-2024-52530)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:9524 advisory.

    The libsoup packages provide an HTTP client and server library for GNOME.

    Security Fix(es):

    * libsoup: HTTP request smuggling via stripping null bytes from the ends of header names (CVE-2024-52530)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:9566 advisory.

    The libsoup packages provide an HTTP client and server library for GNOME.

    Security Fix(es):

    * libsoup: HTTP request smuggling via stripping null bytes from the ends of header names (CVE-2024-52530)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:9525 advisory.

    The libsoup packages provide an HTTP client and server library for GNOME.

    Security Fix(es):

    * libsoup: HTTP request smuggling via stripping null bytes from the ends of header names (CVE-2024-52530)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:9559 advisory.

    The libsoup packages provide an HTTP client and server library for GNOME.

    Security Fix(es):

    * libsoup: infinite loop while reading websocket data (CVE-2024-52532)

    * libsoup: HTTP request smuggling via stripping null bytes from the ends of header names (CVE-2024-52530)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:9572 advisory.

    The libsoup packages provide an HTTP client and server library for GNOME.

    Security Fix(es):

    * libsoup: HTTP request smuggling via stripping null bytes from the ends of header names (CVE-2024-52530)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:9501 advisory.

    The libsoup packages provide an HTTP client and server library for GNOME.

    Security Fix(es):

    * libsoup: HTTP request smuggling via stripping null bytes from the ends of header names (CVE-2024-52530)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
213124	SUSE SLES15 Security Update : libsoup (SUSE-SU-2024:4365-1)	Nessus	SuSE Local Security Checks	high
213122	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : libsoup2 (SUSE-SU-2024:4349-1)	Nessus	SuSE Local Security Checks	high
213120	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : libsoup (SUSE-SU-2024:4355-1)	Nessus	SuSE Local Security Checks	high
213118	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : libsoup (SUSE-SU-2024:4352-1)	Nessus	SuSE Local Security Checks	high
212727	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : libsoup2 (SUSE-SU-2024:4290-1)	Nessus	SuSE Local Security Checks	high
212690	Debian dla-3992 : gir1.2-soup-2.4 - security update	Nessus	Debian Local Security Checks	high
212340	Amazon Linux 2023 : libsoup, libsoup-devel (ALAS2023-2024-772)	Nessus	Amazon Linux Local Security Checks	high
212201	Oracle Linux 7 : libsoup (ELSA-2024-9654)	Nessus	Oracle Linux Local Security Checks	high
211946	Fedora 40 : libsoup3 (2024-bd09057dd2)	Nessus	Fedora Local Security Checks	high
211942	Fedora 41 : mingw-libsoup (2024-af077c1f85)	Nessus	Fedora Local Security Checks	high
211896	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : libsoup vulnerabilities (USN-7126-1)	Nessus	Ubuntu Local Security Checks	high
211895	Ubuntu 22.04 LTS / 24.04 LTS / 24.10 : libsoup3 vulnerabilities (USN-7127-1)	Nessus	Ubuntu Local Security Checks	high
211890	Fedora 40 : mingw-libsoup (2024-8c3476dd24)	Nessus	Fedora Local Security Checks	high
211830	Fedora 39 : libsoup3 (2024-a059ea1dfc)	Nessus	Fedora Local Security Checks	high
211703	CBL Mariner 2.0 Security Update: libsoup (CVE-2024-52530)	Nessus	MarinerOS Local Security Checks	high
211689	RHEL 7 : libsoup (RHSA-2024:9654)	Nessus	Red Hat Local Security Checks	high
211613	Oracle Linux 9 : libsoup (ELSA-2024-9559)	Nessus	Oracle Linux Local Security Checks	high
211598	RockyLinux 8 : libsoup (RLSA-2024:9573)	Nessus	Rocky Linux Local Security Checks	high
210941	Oracle Linux 8 : libsoup (ELSA-2024-9573)	Nessus	Oracle Linux Local Security Checks	high
210910	RHEL 8 : libsoup (RHSA-2024:9573)	Nessus	Red Hat Local Security Checks	high
210908	RHEL 8 : libsoup (RHSA-2024:9524)	Nessus	Red Hat Local Security Checks	high
210905	RHEL 8 : libsoup (RHSA-2024:9566)	Nessus	Red Hat Local Security Checks	high
210904	RHEL 8 : libsoup (RHSA-2024:9525)	Nessus	Red Hat Local Security Checks	high
210901	RHEL 9 : libsoup (RHSA-2024:9559)	Nessus	Red Hat Local Security Checks	high
210900	RHEL 9 : libsoup (RHSA-2024:9572)	Nessus	Red Hat Local Security Checks	high
210885	RHEL 8 : libsoup (RHSA-2024:9501)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2024-52530

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high