An update of the curl package has been released.

For more information about this vulnerability, refer to the security announcements.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5894-1 advisory.

    Harry Sintonen and Tomas Hoger discovered that curl incorrectly handled TELNET connections when the -t     option was used on the command line. Uninitialized data possibly containing sensitive information could be     sent to the remote server, contrary to expectations. This issue was only fixed in Ubuntu 14.04 ESM.
    (CVE-2021-22898, CVE-2021-22925)

    It was discovered that curl incorrectly handled denials when using HTTP proxies. A remote attacker could     use this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary     code. (CVE-2022-43552)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5021-1 advisory.

    Harry Sintonen and Tomas Hoger discovered that curl incorrectly handled TELNET connections when the -t     option was used on the command line. Uninitialized data possibly containing sensitive information could be     sent to the remote server, contrary to expectations. (CVE-2021-22898, CVE-2021-22925)

    Harry Sintonen discovered that curl incorrectly reused connections in the connection pool. This could     result in curl reusing the wrong connections. (CVE-2021-22924)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2734 advisory.

  - curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as     `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a     flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized     data from a stack based buffer to the server, resulting in potentially revealing sensitive internal     information to the server using a clear-text network protocol. (CVE-2021-22898)

  - libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of     them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert'     into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing     wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary     depending on used file systems.The comparison also didn't include the 'issuer cert' which a transfer can     setto qualify how to verify the server certificate. (CVE-2021-22924)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4511 advisory.

  - curl: Leak of authentication credentials in URL via automatic Referer (CVE-2021-22876)

  - CVE-2021-22925 curl: Incorrect fix for  TELNET stack contents disclosure (CVE-2021-22898)

  - curl: Incorrect fix for CVE-2021-22898 TELNET stack contents disclosure (CVE-2021-22925)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as     `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a     flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized     data from a stack based buffer to the server, resulting in potentially revealing sensitive internal     information to the server using a clear-text network protocol. (CVE-2021-22898)

  - curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used     option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for     sending `NEW_ENV` variables, libcurlcould be made to pass on uninitialized data from a stack based buffer     to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-     text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing     the string provided by the application. (CVE-2021-22925)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 6.02, has curl packages installed that are affected by multiple vulnerabilities:

  - curl 7.1.1 to and including 7.75.0 is vulnerable to an Exposure of Private Personal Information to an     Unauthorized Actor by leaking credentials in the HTTP Referer: header. libcurl does not strip off user     credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing     HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second     HTTP request. (CVE-2021-22876)

  - curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as     `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a     flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized     data from a stack based buffer to the server, resulting in potentially revealing sensitive internal     information to the server using a clear-text network protocol. (CVE-2021-22898)

  - curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used     option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for     sending `NEW_ENV` variables, libcurlcould be made to pass on uninitialized data from a stack based buffer     to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-     text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing     the string provided by the application. (CVE-2021-22925)

  - An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow     reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated     with the same credentials as set for this transfer. This affects SASL-enabled protocols: SMPTP(S),     IMAP(S), POP3(S) and LDAP(S) (openldap only). (CVE-2022-22576)

  - An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are     affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with     authentication could leak credentials to other services that exist on different protocols or port numbers.
    (CVE-2022-27774)

  - A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or     cookie header data on HTTP redirects to the same host but another port number. (CVE-2022-27776)

  - libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed     that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for     subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were     left out from the configuration match checks, making themmatch too easily. (CVE-2022-27782)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
150039	Photon OS 3.0: Curl PHSA-2021-3.0-0243	Nessus	PhotonOS Local Security Checks	5/28/2021	8/22/2025	high
184149	Puppet Enterprise < 2019.8.7 / 2021.x < 2021.2 Curl Vulnerabilities	Nessus	Misc.	11/1/2023	11/2/2023	high
171954	Ubuntu 16.04 ESM : curl vulnerabilities (USN-5894-1)	Nessus	Ubuntu Local Security Checks	2/28/2023	8/27/2024	medium
150072	Photon OS 2.0: Curl PHSA-2021-2.0-0349	Nessus	PhotonOS Local Security Checks	5/30/2021	7/23/2024	high
152002	Ubuntu 18.04 LTS / 20.04 LTS : curl vulnerabilities (USN-5021-1)	Nessus	Ubuntu Local Security Checks	7/22/2021	8/27/2024	medium
152547	Debian DLA-2734-1 : curl - LTS security update	Nessus	Debian Local Security Checks	8/13/2021	12/4/2023	low
155067	CentOS 8 : curl (CESA-2021:4511)	Nessus	CentOS Local Security Checks	11/11/2021	11/24/2023	medium
156493	EulerOS Virtualization 3.0.2.6 : curl (EulerOS-SA-2021-2894)	Nessus	Huawei Local Security Checks	1/6/2022	11/21/2023	medium
187340	NewStart CGSL MAIN 6.02 : curl Multiple Vulnerabilities (NS-SA-2023-0071)	Nessus	NewStart CGSL Local Security Checks	12/27/2023	1/2/2024	high

Detections

Analytics

Plugins Search

high

high

medium

high

medium

low

medium

medium

high