Google: net-misc/curl: security update to 19216.220.24

medium Tenable Self-Hosted Container Security Plugin ID 453367

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey` with the curl tool, curl
should check the public key of the server certificate to verify the peer. This check was skipped in a
certain condition that would then make curl allow the connection without performing the proper check, thus
not noticing a possible impostor. To skip this check, the connection had to be done with QUIC with ngtcp2
built to use GnuTLS and the user had to explicitly disable the standard certificate verification.
(CVE-2025-13034)

Solution

Update the net-misc/curl library and its related packages to version 19216.220.24 or later.

Plugin Details

Severity: Medium

ID: 453367

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/1/2026

Updated: 10/1/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.66

Vendor

Vendor Severity: MEDIUM

CVSS v2

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4

Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:C/A:N

CVSS Score Source: CVE-2025-13034

CVSS v3

Risk Factor: Medium

Base Score: 5.9

Temporal Score: 5.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 1/8/2026

Reference Information

CVE: CVE-2025-13034

Detections

Analytics