Detections
Analytics
Alpine: curl: security update to 7.52.1-r1
high Tenable Self-Hosted Container Security Plugin ID 403963
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh
proof of the server's certificate's validity in the code that checks for a test success or failure. It
ends up always thinking there's valid proof, even when there is none or if the server doesn't support the
TLS extension in question. This could lead to users not detecting when a server's certificate goes invalid
or otherwise be mislead that the server is in a better shape than it is in reality. This flaw also exists
in the command line tool (--cert-status). (CVE-2017-2629)
- The ourWriteOut function in tool_writeout.c in curl 7.53.1 might allow physically proximate attackers to
obtain sensitive information from process memory in opportunistic circumstances by reading a workstation
screen during use of a --write-out argument ending in a '%' character, which leads to a heap-based buffer
over-read. (CVE-2017-7407)
- In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to resume a TLS session even if
the client certificate had changed. That is unacceptable since a server by specification is allowed to
skip the client certificate check on resume, and may instead use the old identity which was established by
the previous certificate (or no certificate). libcurl supports by default the use of TLS session id/ticket
to resume previous TLS sessions to speed up subsequent TLS handshakes. They are used when for any reason
an existing TLS connection couldn't be kept alive to make the next handshake faster. This flaw is a
regression and identical to CVE-2016-5419 reported on August 3rd 2016, but affecting a different version
range. (CVE-2017-7468)
See Also
https://security.alpinelinux.org/vuln/CVE-2017-2629
Plugin Details
Severity: High
ID: 403963
Version: Revision 1.24
Type: Local
Published: 10/31/2023
Updated: 3/12/2025
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.18
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N
CVSS Score Source: CVE-2017-7468
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 2/22/2017