The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3613 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3613-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/               Emilio Pozuelo Monfort     October 11, 2023                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : curl     Version        : 7.64.0-4+deb10u7     CVE ID         : CVE-2023-28321 CVE-2023-38546

    Two security issues were found in Curl, an easy-to-use client-side URL     transfer library and command line tool.

    CVE-2023-28321

        Hiroki Kurosawa found that curl could mismatch hostnames with         wildcards when using its own name matching function.

    CVE-2023-38546

        It was discovered that under some circumstances libcurl was         susceptible to cookie injection.

    For Debian 10 buster, these problems have been fixed in version     7.64.0-4+deb10u7.

    We recommend that you upgrade your curl packages.

    For the detailed security status of curl please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/curl

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian dla-3613 : curl - security update

medium Nessus Plugin ID 182933

Version 1.5