The version of curl installed on the remote host is prior to 8.7.1. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-087-01 advisory.

  - When a protocol selection parameter option disables all protocols without adding any then the default set     of protocols would remain in the allowed set due to an error in the logic for removing protocols. The     below command would perform a request to curl.se with a plaintext protocol which has been explicitly     disabled. curl --proto -all,-http http://curl.se The flaw is only present if the set of selected protocols     disables the entire set of available protocols, in itself a command with no practical use and therefore     unlikely to be encountered in real situations. The curl security team has thus assessed this to be low     severity bug. (CVE-2024-2004)

  - libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to     use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the     verification and returns OK, thus ignoring any certificate problems. (CVE-2024-2379)

  - When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers     for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting,     libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory.
    Further, this error condition fails silently and is therefore not easily detected by an application.
    (CVE-2024-2398)

  - libcurl did not check the server certificate of TLS connections done to a host specified as an IP address,     when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified     hostname was given as an IP address, therefore completely skipping the certificate check. This affects all     uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc). (CVE-2024-2466)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Slackware Linux 15.0 / current curl Multiple Vulnerabilities (SSA:2024-087-01)

high Nessus Plugin ID 192632

Version 1.3

Version 1.2

Version 1.1

Version 1.0

Version 1.3 Jul 26, 2024, 11:33 AM IAVM reference Plugin Feed: 202407261133
Version 1.2 Jul 4, 2024, 8:15 AM CVSS metrics ("CVSSv3 score" set to 8.6) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L") Plugin Feed: 202407040815
Version 1.1 Mar 29, 2024, 1:58 PM IAVM reference STIG Severity (set) Plugin Feed: 202403291358
Version 1.0 Mar 28, 2024, 12:14 AM New Plugin Feed: 202403280014