Alpine: curl: security update to 7.88.1-r1

high Tenable Cloud Security Plugin ID 404036

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may
allow an attacker to pass on maliciously crafted user name and "telnet options" during server negotiation.
The lack of proper input scrubbing allows an attacker to send content or perform option negotiation
without the application's intent. This vulnerability could be exploited if an application allows user
input, thereby enabling attackers to execute arbitrary code on the system. (CVE-2023-27533)

- A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to
be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as
the first element to indicate a path relative to the user's home directory. Attackers can exploit this
flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a
server with a specific user. (CVE-2023-27534)

- An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that
can result in wrong credentials being used during subsequent transfers. Previously created connections are
kept in a connection pool for reuse if they match the current setup. However, certain FTP settings such as
CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC, and CURLOPT_USE_SSL were not
included in the configuration match checks, causing them to match too easily. This could lead to libcurl
using the wrong credentials when performing a transfer, potentially allowing unauthorized access to
sensitive information. (CVE-2023-27535)

- An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can
reuse previously established connections with incorrect user permissions due to a failure to check for
changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI
transfers and could potentially result in unauthorized access to sensitive information. The safest option
is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed. (CVE-2023-27536)

Plugin Details

Severity: High

ID: 404036

Version: Revision 1.30

Type: Local

Family: Alpine Linux Local Security Checks

Published: 10/31/2023

Updated: 4/3/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5.7

Percentile: 96.65

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2023-27533

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS Score Source: CVE-2023-27534

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 3/20/2023

Reference Information

CVE: CVE-2023-27533, CVE-2023-27534, CVE-2023-27535, CVE-2023-27536, CVE-2023-27537, CVE-2023-27538

IAVA: 2023-A-0153-S, 2023-A-0531-S

Detections

Analytics