Debian DLA-3288-1 : curl - LTS security update

critical Nessus Plugin ID 170757

Language:

Synopsis

The remote Debian host is missing one or more security-related updates.

Description

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3288 advisory.

- An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers.
(CVE-2022-27774)

- libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were left out from the configuration match checks, making themmatch too easily. (CVE-2022-27782)

- When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request. The problem exists in the logic for a reused handle when it is changed from a PUT to a POST. (CVE-2022-32221)

- When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses.
Effectively allowing asister site to deny service to all siblings. (CVE-2022-35252)

- No description is available for this CVE. (CVE-2022-43551) (CVE-2022-43552)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade the curl packages.

For Debian 10 buster, these problems have been fixed in version 7.64.0-4+deb10u4.

Plugin Details

Severity: Critical

ID: 170757

File Name: debian_DLA-3288.nasl

Version: 1.3

Type: local

Agent: unix

Family: Debian Local Security Checks

Published: 1/28/2023

Updated: 9/5/2023

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 4.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2022-27782

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 9.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

CVSS Score Source: CVE-2022-32221

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:libcurl4, p-cpe:/a:debian:debian_linux:curl, cpe:/o:debian:debian_linux:10.0, p-cpe:/a:debian:debian_linux:libcurl3-nss, p-cpe:/a:debian:debian_linux:libcurl4-gnutls-dev, p-cpe:/a:debian:debian_linux:libcurl4-doc, p-cpe:/a:debian:debian_linux:libcurl3-gnutls, p-cpe:/a:debian:debian_linux:libcurl4-nss-dev, p-cpe:/a:debian:debian_linux:libcurl4-openssl-dev

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 1/28/2023

Vulnerability Publication Date: 4/28/2022

Reference Information

CVE: CVE-2022-27774, CVE-2022-27782, CVE-2022-32221, CVE-2022-35252, CVE-2022-43552

IAVA: 2022-A-0224-S, 2022-A-0350-S, 2022-A-0451-S, 2023-A-0008-S

Detections

Analytics