curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.

On May 26, 2021 curl published security updates addressing 3 CVEs: CVE-2021-22897 (Low) CVE-2021-22898 (Medium)  CVE-2021-22901 (High). Previous releases of Puppet Agent contain this vulnerable version of curl.  For more information  about this vulnerability, refer to the curl ecurity announcements.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

For more information about this vulnerability, refer to the security announcements.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of curl installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-22897 advisory.

  - curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the     code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected     cipher set was stored in a single static variable in the library, which has the surprising side-effect     that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will     accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport     security significantly. (CVE-2021-22897)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - curl 7.1.1 to and including 7.75.0 is vulnerable to an 'Exposure of Private Personal Information to an     Unauthorized Actor' by leaking credentials in the HTTP Referer: header. libcurl does not strip off user     credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing     HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second     HTTP request. (CVE-2021-22876)

  - curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the     code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected     cipher set was stored in a single 'static' variable in the library, which has the surprising side-effect     that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will     accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport     security significantly. (CVE-2021-22897)

  - curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as     `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a     flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized     data from a stack based buffer to the server, resulting in potentially revealing sensitive internal     information to the server using a clear-text network protocol. (CVE-2021-22898)

  - When curl is instructed to download content using the metalink feature, thecontents is verified against a     hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same     contentfrom a set of different URLs, potentially hosted by different servers and theclient can then     download the file from one or several of them. In a serial orparallel manner.If one of the servers hosting     the contents has been breached and the contentsof the specific file on that server is replaced with a     modified payload, curlshould detect this when the hash of the file mismatches after a completeddownload.
    It should remove the contents and instead try getting the contentsfrom another URL. This is not done, and     instead such a hash mismatch is onlymentioned in text and the potentially malicious content is kept in the     file ondisk. (CVE-2021-22922)

  - When curl is instructed to get content using the metalink feature, and a user name and password are used     to download the metalink XML file, those same credentials are then subsequently passed on to each of the     servers from which curl will download or try to download the contents from. Often contrary to the user's     expectations and intentions and without telling the user it happened. (CVE-2021-22923)

  - libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of     them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert'     into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing     wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary     depending on used file systems.The comparison also didn't include the 'issuer cert' which a transfer can     setto qualify how to verify the server certificate. (CVE-2021-22924)

  - curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used     option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for     sending `NEW_ENV` variables, libcurlcould be made to pass on uninitialized data from a stack based buffer     to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-     text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing     the string provided by the application. (CVE-2021-22925)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Junos OS installed on the remote host is affected by multiple vulnerabilities as referenced in the JSA11289 advisory.

  - curl 7.1.1 to and including 7.75.0 is vulnerable to an Exposure of Private Personal Information to an     Unauthorized Actor by leaking credentials in the HTTP Referer: header. libcurl does not strip off user     credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing     HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second     HTTP request. (CVE-2021-22876)

  - curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a     connection due to bad handling of TLS 1.3 session tickets. When using a HTTPS proxy and TLS 1.3, libcurl     can confuse session tickets arriving from the HTTPS proxy but work as if they arrived from the remote     server and then wrongly short-cut the host handshake. When confusing the tickets, a HTTPS proxy can     trick libcurl to use the wrong session ticket resume for the host and thereby circumvent the server TLS     certificate check and make a MITM attack to be possible to perform unnoticed. Note that such a malicious     HTTPS proxy needs to provide a certificate that curl will accept for the MITMed server for an attack to     work - unless curl has been told to ignore the server certificate check. (CVE-2021-22890)

  - curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the     code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected     cipher set was stored in a single static variable in the library, which has the surprising side-effect     that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will     accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport     security significantly. (CVE-2021-22897)

  - curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as     `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a     flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized     data from a stack based buffer to the server, resulting in potentially revealing sensitive internal     information to the server using a clear-text network protocol. (CVE-2021-22898)

  - curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory     being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use this in     rare unfortunate circumstances to potentially reach remote code execution in the client. When libcurl at     run-time sets up support for TLS 1.3 session tickets on a connection using OpenSSL, it stores pointers to     the transfer in-memory object for later retrieval when a session ticket arrives. If the connection is used     by multiple transfers (like with a reused HTTP/1.1 connection or multiplexed HTTP/2 connection) that first     transfer object might be freed before the new session is established on that connection and then the     function will access a memory buffer that might be freed. When using that memory, libcurl might even call     a function pointer in the object, making it possible for a remote code execution if the server could     somehow manage to get crafted memory content into the correct place in memory. (CVE-2021-22901)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - curl is a command line tool for transferring data with     URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP,     SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMAP,     SMTP, POP3 and RTSP. curl supports SSL certificates,     HTTP POST, HTTP PUT, FTP uploading, HTTP form based     upload, proxies, cookies, user+password authentication     (Basic, Digest, NTLM, Negotiate, kerberos...), file     transfer resume, proxy tunneling and a busload of other     useful tricks.Security Fix(es):A flaw was found in curl     where libcurl lets applications specify which specific     TLS ciphers to use in transfers, using the option     called CURLOPT_SSL_CIPHER_LIST. The cipher selection is     used for the TLS negotiation when a transfer is done     involving any of the TLS based transfer protocols     libcurl sup(CVE-2021-22897)curl 7.7 through 7.76.1     suffers from an information disclosure when the `-t`     command line option, known as `CURLOPT_TELNETOPTIONS`     in libcurl, is used to send variable=content pairs to     TELNET servers. Due to a flaw in the option parser for     sending NEW_ENV variables, libcurl could be made to     pass on uninitialized data from a stack based buffer to     the server, resulting in potentially revealing     sensitive internal information to the server using a     clear-text network protocol.(CVE-2021-22898)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - curl 7.7 through 7.76.1 suffers from an information     disclosure when the `-t` command line option, known as     `CURLOPT_TELNETOPTIONS` in libcurl, is used to send     variable=content pairs to TELNET servers. Due to a flaw     in the option parser for sending NEW_ENV variables,     libcurl could be made to pass on uninitialized data     from a stack based buffer to the server, resulting in     potentially revealing sensitive internal information to     the server using a clear-text network     protocol.(CVE-2021-22898)

  - curl 7.61.0 through 7.76.1 suffers from exposure of     data element to wrong session due to a mistake in the     code for CURLOPT_SSL_CIPHER_LIST when libcurl is built     to use the Schannel TLS library. The selected cipher     set was stored in a single 'static' variable in the     library, which has the surprising side-effect that if     an application sets up multiple concurrent transfers,     the last one that sets the ciphers will accidentally     control the set used by all transfers. In a worst-case     scenario, this weakens transport security     significantly.(CVE-2021-22897)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - curl 7.7 through 7.76.1 suffers from an information     disclosure when the `-t` command line option, known as     `CURLOPT_TELNETOPTIONS` in libcurl, is used to send     variable=content pairs to TELNET servers. Due to a flaw     in the option parser for sending NEW_ENV variables,     libcurl could be made to pass on uninitialized data     from a stack based buffer to the server, resulting in     potentially revealing sensitive internal information to     the server using a clear-text network     protocol.(CVE-2021-22898)

  - curl 7.61.0 through 7.76.1 suffers from exposure of     data element to wrong session due to a mistake in the     code for CURLOPT_SSL_CIPHER_LIST when libcurl is built     to use the Schannel TLS library. The selected cipher     set was stored in a single 'static' variable in the     library, which has the surprising side-effect that if     an application sets up multiple concurrent transfers,     the last one that sets the ciphers will accidentally     control the set used by all transfers. In a worst-case     scenario, this weakens transport security     significantly.(CVE-2021-22897)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the curl package has been released.

ID	Name	Product	Family	Severity
184151	Puppet Agent 6.x < 6.23.0 / 7.x < 7.8.0 Multiple Vulnerabilities	Nessus	Windows	high
184149	Puppet Enterprise < 2019.8.7 / 2021.x < 2021.2 Curl Vulnerabilities	Nessus	Misc.	high
172939	CBL Mariner 2.0 Security Update: curl (CVE-2021-22897)	Nessus	MarinerOS Local Security Checks	medium
157964	EulerOS Virtualization 3.0.6.0 : curl (EulerOS-SA-2022-1062)	Nessus	Huawei Local Security Checks	medium
156677	Juniper Junos OS Multiple Vulnerabilities (JSA11289)	Nessus	Junos Local Security Checks	high
152337	EulerOS 2.0 SP9 : curl (EulerOS-SA-2021-2265)	Nessus	Huawei Local Security Checks	medium
152334	EulerOS 2.0 SP9 : curl (EulerOS-SA-2021-2239)	Nessus	Huawei Local Security Checks	medium
152278	EulerOS 2.0 SP8 : curl (EulerOS-SA-2021-2290)	Nessus	Huawei Local Security Checks	medium
151542	EulerOS Virtualization 2.9.0 : curl (EulerOS-SA-2021-2206)	Nessus	Huawei Local Security Checks	medium
151537	EulerOS Virtualization 2.9.1 : curl (EulerOS-SA-2021-2176)	Nessus	Huawei Local Security Checks	medium
151435	Photon OS 2.0: Curl PHSA-2021-2.0-0366	Nessus	PhotonOS Local Security Checks	medium

Detections

Analytics

CVE-2021-22897

medium

Tenable Plugins

high

high

medium

medium

high

medium

medium

medium

medium

medium

medium