Alpine: multiple curl packages, libcurl: security update to 7.76.1-r0 (deprecated)

high Tenable Cloud Security Plugin ID 400213

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the
code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected
cipher set was stored in a single "static" variable in the library, which has the surprising side-effect
that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will
accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport
security significantly. (CVE-2021-22897)

- curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as
`CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a
flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized
data from a stack based buffer to the server, resulting in potentially revealing sensitive internal
information to the server using a clear-text network protocol. (CVE-2021-22898)

- curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory
being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use this in
rare unfortunate circumstances to potentially reach remote code execution in the client. When libcurl at
run-time sets up support for TLS 1.3 session tickets on a connection using OpenSSL, it stores pointers to
the transfer in-memory object for later retrieval when a session ticket arrives. If the connection is used
by multiple transfers (like with a reused HTTP/1.1 connection or multiplexed HTTP/2 connection) that first
transfer object might be freed before the new session is established on that connection and then the
function will access a memory buffer that might be freed. When using that memory, libcurl might even call
a function pointer in the object, making it possible for a remote code execution if the server could
somehow manage to get crafted memory content into the correct place in memory. (CVE-2021-22901)

Plugin Details

Severity: High

ID: 400213

Version: Revision 1.24

Type: Local

Family: Alpine Linux Local Security Checks

Published: 8/16/2023

Updated: 4/9/2024

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.6

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2021-22901

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.5

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 5/26/2021

Vulnerability Publication Date: 5/28/2021

Reference Information

CVE: CVE-2021-22897, CVE-2021-22898, CVE-2021-22901

Detections

Analytics