The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2773 advisory.

    Two issues have been found in curl, a command line tool and an easy-to-use client-side library for     transferring data with URL syntax. CVE-2021-22946 Crafted answers from a server might force clients to not     use TLS on connections though TLS was required and expected. CVE-2021-22947 When using STARTTLS to     initiate a TLS connection, the server might send multiple answers before the TLS upgrade and such the     client would handle them as being trusted. This could be used by a MITM-attacker to inject fake response     data. For Debian 9 stretch, these problems have been fixed in version 7.52.1-5+deb9u16. We recommend that     you upgrade your curl packages. For the detailed security status of curl please refer to its security     tracker page at: https://security-tracker.debian.org/tracker/curl Further information about Debian LTS     security advisories, how to apply these updates to your system and frequently asked questions can be found     at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian DLA-2773-1 : curl - LTS security update

critical Nessus Plugin ID 153845

Version 1.5