Detections
Analytics

Echo: multiple curl-8.1.1 packages: security update to 7.88.0

critical Tenable Cloud Security Plugin ID 476274

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause
 HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be
 instructed to use HTTPS instead of usingan insecure clear-text HTTP step even when HTTP is provided in the
 URL. ThisHSTS mechanism would however surprisingly be ignored by subsequent transferswhen done on the same
 command line because the state would not be properlycarried on. (CVE-2023-23914)

Solution

Update the curl-8.1.1 library and its related packages to version 7.88.0 or later.

See Also

https://advisory.echohq.com/cve/CVE-2023-23914

Plugin Details

Severity: Critical

ID: 476274

Version: Revision 1.1

Type: Local

Published: 10/20/2026

Updated: 10/20/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.04

CVSS v2

Risk Factor: High

Base Score: 9.4

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N

CVSS Score Source: CVE-2023-23914

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Temporal Score: 8.2

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/20/2026

Vulnerability Publication Date: 2/17/2023

Reference Information

CVE: CVE-2023-23914