The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-1610 advisory.

    - curl: Inferior OCSP verification (CVE-2020-8286)
    - libcurl: FTP wildcard stack overflow (CVE-2020-8285)
    - curl: trusting FTP PASV responses (CVE-2020-8284)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for curl fixes the following issues :

CVE-2020-8286: Fixed improper OSCP verification in the client side (bsc#1179593).

CVE-2020-8285: Fixed a stack overflow due to FTP wildcard (bsc#1179399).

CVE-2020-8284: Fixed an issue where a malicius FTP server could make curl connect to a different IP (bsc#1179398).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in curl, a command line tool for transferring data with URL syntax and an easy-to-use client-side URL transfer library.

CVE-2020-8284

When curl performs a passive FTP transfer, it first tries the EPSV command and if that is not supported, it falls back to using PASV.
Passive mode is what curl uses by default. A server response to a PASV command includes the (IPv4) address and port number for the client to connect back to in order to perform the actual data transfer. This is how the FTP protocol is designed to work. A malicious server can use the PASV response to trick curl into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.

The IP address part of the response is now ignored by default, by making CURLOPT_FTP_SKIP_PASV_IP default to 1L instead of previously being 0L. This has the minor drawback that a small fraction of use cases might break, when a server truly needs the client to connect back to a different IP address than what the control connection uses and for those CURLOPT_FTP_SKIP_PASV_IP can be set to 0L. The same goes for the command line tool, which then might need

--no-ftp-skip-pasv-ip set to prevent curl from ignoring the address in the server response.

CVE-2020-8285

libcurl offers a wildcard matching functionality, which allows a callback (set with CURLOPT_CHUNK_BGN_FUNCTION) to return information back to libcurl on how to handle a specific entry in a directory when libcurl iterates over a list of all available entries. When this callback returns CURL_CHUNK_BGN_FUNC_SKIP, to tell libcurl to not deal with that file, the internal function in libcurl then calls itself recursively to handle the next directory entry. If there's a sufficient amount of file entries and if the callback returns 'skip' enough number of times, libcurl runs out of stack space. The exact amount will of course vary with platforms, compilers and other environmental factors. The content of the remote directory is not kept on the stack, so it seems hard for the attacker to control exactly what data that overwrites the stack - however it remains a denial of service vector as a malicious user who controls a server that a libcurl-using application works with under these premises can trigger a crash.

The internal function is rewritten to instead and more appropriately use an ordinary loop instead of the recursive approach. This way, the stack use will remain the same no matter how many files that are skipped.

CVE-2020-8286

libcurl offers 'OCSP stapling' via the CURLOPT_SSL_VERIFYSTATUS option. When set, libcurl verifies the OCSP response that a server responds with as part of the TLS handshake. It then aborts the TLS negotiation if something is wrong with the response. The same feature can be enabled with --cert-status using the curl tool. As part of the OCSP response verification, a client should verify that the response is indeed set out for the correct certificate. This step was not performed by libcurl when built or told to use OpenSSL as TLS backend.
This flaw would allow an attacker, who perhaps could have breached a TLS server, to provide a fraudulent OCSP response that would appear fine, instead of the real one. Like if the original certificate actually has been revoked.

The OCSP response checker function now also verifies that the certificate id is the correct one.

For Debian 9 stretch, these problems have been fixed in version 7.52.1-5+deb9u13.

We recommend that you upgrade your curl packages.

For the detailed security status of curl please refer to its security tracker page at: https://security-tracker.debian.org/tracker/curl

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Vulnerability Summary for CVE-2020-8169(CVE-2020-8169)

  - Vulnerability Summary for CVE-2020-8177(CVE-2020-8177)

  - Expired pointer dereference via multi API with     `CURLOPT_CONNECT_ONLY` option set(CVE-2020-8231)

  - curl 7.21.0 to and including 7.73.0 is vulnerable to     uncontrolled recursion due to a stack overflow issue in     FTP wildcard match parsing.(CVE-2020-8285)

  - curl 7.41.0 through 7.73.0 is vulnerable to an improper     check for certificate revocation due to insufficient     verification of the OCSP response.(CVE-2020-8286)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2021:0078 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-3822:
    libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The     function creating an outgoing NTLM type-3 header     (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents     based on previously received data. The check that exists to prevent the local buffer from getting     overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from     happening. This output data can grow larger than the local buffer if very large 'nt response' data is     extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a 'large     value' needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes     from the NTLMv2 type-2 response header.

    CVE-2019-3823:
    libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code     handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp()` isn't NUL terminated and     contains no character ending the parsed number, and `len` is set to 5, then the `strtol()` call reads     beyond the allocated buffer. The read contents will not be returned to the caller.

    CVE-2019-5436:
    A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl     versions 7.19.4 through 7.64.1.

    CVE-2019-5481:
    Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.

    CVE-2019-5482:
    Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.

    CVE-2020-8177:
    curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources     that can lead too overwriting a local file when the -J flag is used.

    CVE-2020-8231:
    Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending     data.

    CVE-2020-8284:
    A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to     a given IP address and port, and this way potentially make curl extract information about services that     are otherwise private and not disclosed, for example doing port scanning and service banner extractions.

    CVE-2020-8285:
    curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue     in FTP wildcard match parsing.

    CVE-2020-8286:
    curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to     insufficient verification of the OCSP response.

    CVE-2021-22946:
    A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an     IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL`     or `CURLUSESSL_ALL` withlibcurl). This requirement could be bypassed if the server would return a properly     crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations
    **withoutTLS** contrary to the instructions and expectations, exposing possibly sensitive data in clear     text over the network.

    CVE-2021-22947:
    When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to     upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches.
    curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using     and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw,     it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS     traffic from the legitimate server and trick curl into sending data back to the user thinking the     attacker's injected data comes from the TLS-protected server.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2023-0808 advisory.

  - The go command may execute arbitrary code at build time when using cgo. This may occur when running go     get on a malicious module, or when running any other command which builds untrusted code. This is can by     triggered by linker flags, specified via a #cgo LDFLAGS directive. Flags containing embedded spaces are     mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in     the argument of another flag. This only affects usage of the gccgo compiler. (CVE-2023-29405)

  - When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by     finalizing the operation with a rename from a temporary name to the final target file name.In that rename     operation, it might accidentally *widen* the permissions for the target file, leaving the updated file     accessible to more users than intended. (CVE-2022-32207)

  - decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS. (CVE-2022-38900)

  - The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.
    (CVE-2022-33987)

  - Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the     name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3. (CVE-2022-37601)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
149932	Oracle Linux 8 : curl (ELSA-2021-1610)	Nessus	Oracle Linux Local Security Checks	5/26/2021	10/22/2024	high
144027	SUSE SLED15 / SLES15 Security Update : curl (SUSE-SU-2020:3735-1)	Nessus	SuSE Local Security Checks	12/10/2020	5/8/2026	high
144497	Debian DLA-2500-1 : curl security update	Nessus	Debian Local Security Checks	12/21/2020	5/8/2026	high
147470	EulerOS Virtualization 2.9.1 : curl (EulerOS-SA-2021-1596)	Nessus	Huawei Local Security Checks	3/10/2021	1/11/2024	high
236591	Alibaba Cloud Linux 3 : 0078: curl (ALINUX3-SA-2021:0078)	Nessus	Alibaba Cloud Linux Local Security Checks	5/14/2025	5/15/2025	critical
194926	Universal Forwarder 8.2.0 < 8.2.12, 9.0.0 < 9.0.6, 9.1.0 < 9.1.1 (SVD-2023-0809)	Nessus	CGI abuses	5/2/2024	5/30/2024	critical
194928	Splunk Enterprise 8.2.0 < 8.2.12, 9.0.0 < 9.0.6, 9.1.0 < 9.1.1 (SVD-2023-0808)	Nessus	CGI abuses	5/2/2024	7/29/2024	critical

Detections

Analytics

Plugins Search

high

high

high

high

critical

critical

critical