When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects curl using applications that enable HSTS and use URLs with the insecure `HTTP://` scheme and perform transfers with hosts like `x.example.com` as well as `example.com` where the first host is a subdomain of the second host. (The HSTS cache either needs to have been populated manually or there needs to have been previous HTTPS accesses done as the cache needs to have entries for the domains involved to trigger this problem.) When `x.example.com` responds with `Strict-Transport-Security:` headers, this bug can make the subdomain's expiry timeout *bleed over* and get set for the parent domain `example.com` in curl's HSTS cache. The result of a triggered bug is that HTTP accesses to `example.com` get converted to HTTPS for a different period of time than what was asked for by the origin server. If `example.com` for example stops supporting HTTPS at its expiry time, curl might then fail to access `http://example.com` until the (wrongly set) timeout expires. This bug can also expire the parent's entry *earlier*, thus making curl inadvertently switch back to insecure HTTP earlier than otherwise intended.

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2024:3927-2 advisory.

    - CVE-2024-9681: Fixed HSTS subdomain overwrites parent cache entry (bsc#1232528)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by a vulnerability as referenced in the USN-7104-1 advisory.

    It was discovered that curl could overwrite the HSTS expiry of the parent domain with the subdomain's HSTS     entry. This could lead to curl switching back to insecure HTTP earlier than otherwise intended, resulting     in information exposure.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the curl package has been released.

The version of Curl installed on the remote host is between 7.74.0 and prior to 8.10.1. It is, therefore, affected by a potential minor DoS security problem when trying to use HTTPS when that no longer works or a cleartext transmission of data that was otherwise intended to possibly be protected.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2024:3927-1 advisory.

    - CVE-2024-9681: Fixed HSTS subdomain overwrites parent cache entry (bsc#1232528)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:3925-1 advisory.

    - CVE-2024-9681: Fixed HSTS subdomain overwrites parent cache entry (bsc#1232528)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:3926-1 advisory.

    - CVE-2024-9681: Fixed HSTS subdomain overwrites parent cache entry (bsc#1232528)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
213267	SUSE SLES12 Security Update : curl (SUSE-SU-2024:3927-2)	Nessus	SuSE Local Security Checks	medium
211514	Ubuntu 22.04 LTS / 24.04 LTS / 24.10 : curl vulnerability (USN-7104-1)	Nessus	Ubuntu Local Security Checks	medium
210890	Photon OS 3.0: Curl PHSA-2024-3.0-0802	Nessus	PhotonOS Local Security Checks	medium
210755	Photon OS 4.0: Curl PHSA-2024-4.0-0709	Nessus	PhotonOS Local Security Checks	medium
210719	Photon OS 5.0: Curl PHSA-2024-5.0-0392	Nessus	PhotonOS Local Security Checks	medium
210585	Curl 7.74.0 < 8.10.1 Input Misinterpretation (CVE-2024-9681)	Nessus	Misc.	medium
210473	SUSE SLES12 Security Update : curl (SUSE-SU-2024:3927-1)	Nessus	SuSE Local Security Checks	medium
210472	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : curl (SUSE-SU-2024:3925-1)	Nessus	SuSE Local Security Checks	medium
210469	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : curl (SUSE-SU-2024:3926-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2024-9681

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium