Detections
Analytics

Echo: curl-8.1.1: security update to 8.1.1+e2

low Tenable Self-Hosted Container Security Plugin ID 478549

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - When a protocol selection parameter option disables all protocols without adding any then the default set
 of protocols would remain in the allowed set due to an error in the logic for removing protocols. The
 below command would perform a request to curl.se with a plaintext protocol which has been explicitly
 disabled. curl --proto -all,-http http://curl.se The flaw is only present if the set of selected protocols
 disables the entire set of available protocols, in itself a command with no practical use and therefore
 unlikely to be encountered in real situations. The curl security team has thus assessed this to be low
 severity bug. (CVE-2024-2004)

Solution

Update the curl-8.1.1 library and its related packages to version 8.1.1+e2 or later.

See Also

https://advisory.echohq.com/cve/CVE-2024-2004

Plugin Details

Severity: Low

ID: 478549

Version: Revision 1.1

Type: Local

Published: 11/5/2026

Updated: 11/5/2026

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:P/I:P/A:P

CVSS Score Source: CVE-2024-2004

CVSS v3

Risk Factor: Low

Base Score: 3.5

Temporal Score: 3.2

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/5/2026

Vulnerability Publication Date: 3/27/2024

Reference Information

CVE: CVE-2024-2004