Detections
Analytics
EulerOS Virtualization 2.12.0 : curl (EulerOS-SA-2026-1478)
medium Nessus Plugin ID 302601
Synopsis
The remote EulerOS Virtualization host is missing multiple security updates.Description
According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl,changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrently setup transfers.Disabling certificate verification for a specific transfer could unintentionally disable the feature for other threads as well.(CVE-2025-14017)
When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP,POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host.(CVE-2025-14524)
When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a locally running SSH agent.(CVE-2025-15224)
When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts *not present* in the specified file if they were added as recognized in the libssh *global* known_hosts file.(CVE-2025-15079)
curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms.This prevents curl from detecting MITM attackers and more.(CVE-2025-10966)
1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3.
The same cookie name is set - but with just a slash as path (`path=\'/\',`). Since this site is not secure, the cookie *should* just be ignored. 4. A bug in the path comparison logic makes curl read outside a heap buffer boundary The bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path. The presumed and correct behavior would be to plainly ignore the second set of the cookie since it was already set as secure on a secure host so overriding it on an insecure host should not be okay.(CVE-2025-9086)
Tenable has extracted the preceding description block directly from the EulerOS Virtualization curl security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update the affected curl packages.See Also
Plugin Details
Severity: Medium
ID: 302601
File Name: EulerOS_SA-2026-1478.nasl
Version: 1.1
Type: local
Family: Huawei Local Security Checks
Published: 3/16/2026
Updated: 3/16/2026
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.2
CVSS v2
Risk Factor: High
Base Score: 7.6
Temporal Score: 6
Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2025-9086
CVSS v3
Risk Factor: Medium
Base Score: 6.3
Temporal Score: 5.7
Vector: CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
CVSS Score Source: CVE-2025-14017
Vulnerability Information
CPE: cpe:/o:huawei:euleros:uvp:2.12.0, p-cpe:/a:huawei:euleros:curl, p-cpe:/a:huawei:euleros:libcurl
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/EulerOS/release, Host/EulerOS/rpm-list, Host/EulerOS/uvp_version
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 3/16/2026
Vulnerability Publication Date: 9/12/2025
Reference Information
CVE: CVE-2025-10966, CVE-2025-14017, CVE-2025-14524, CVE-2025-15079, CVE-2025-15224, CVE-2025-9086