The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-2884ba1528 advisory.

    - fix SSH connection too eager reuse still (CVE-2023-27538)
    - fix HSTS double-free (CVE-2023-27537)
    - fix GSS delegation too eager connection re-use (CVE-2023-27536)
    - fix FTP too eager connection reuse (CVE-2023-27535)
    - fix SFTP path ~ resolving discrepancy (CVE-2023-27534)
    - fix TELNET option IAC injection (CVE-2023-27533)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:1582-1 advisory.

    - CVE-2023-27533: Fixed TELNET option IAC injection (bsc#1209209).
    - CVE-2023-27534: Fixed SFTP path ~ resolving discrepancy (bsc#1209210).
    - CVE-2023-27535: Fixed FTP too eager connection reuse (bsc#1209211).
    - CVE-2023-27536: Fixed GSS delegation too eager connection reuse (bsc#1209212).
    - CVE-2023-27538: Fixed SSH connection too eager reuse still (bsc#1209214).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2228-1 advisory.

    - CVE-2023-28320: Fixed siglongjmp race condition (bsc#1211231).
    - CVE-2023-28321: Fixed IDN wildcard matching (bsc#1211232).
    - CVE-2023-28322: Fixed POST-after-PUT confusion (bsc#1211233).
    - CVE-2023-27533: Fixed TELNET option IAC injection (bsc#1209209).
    - CVE-2023-27534: Fixed SFTP path ~ resolving discrepancy (bsc#1209210).
    - CVE-2023-27535: Fixed FTP too eager connection reuse (bsc#1209211).
    - CVE-2023-27536: Fixed GSS delegation too eager connection reuse (bsc#1209212).
    - CVE-2023-27538: Fixed SSH connection too eager reuse still (bsc#1209214).
    - CVE-2022-43552: HTTP Proxy deny use-after-free (bsc#1206309).
    - CVE-2023-23916: Fixed HTTP multi-header compression denial of service (bsc#1207992).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of curl installed on the remote host is prior to 8.0.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2070 advisory.

    The curl advisory describes this issue as follows:

    curl supports communicating using the TELNET protocol and as a part of this it offers users to pass on     user name and telnet options for the server negotiation.

    Due to lack of proper input scrubbing and without it being the documented functionality, curl would pass     on user name and telnet options to the server as provided. This could allow users to pass in carefully     crafted content that pass on content or do option negotiation without the application intending to do so.
    In particular if an application for example allows users to provide the data or parts of the data.
    (CVE-2023-27533)

    The curl advisory describes this issue as follows:

    curl supports SFTP transfers. curl's SFTP implementation offers a special feature in the path component of     URLs: a tilde (~) character as the first path element in the path to denotes a path relative to the user's     home directory. This is supported because of wording in the once proposed to-become RFC draft that was to     dictate how SFTP URLs work.

    Due to a bug, the handling of the tilde in SFTP path did however not only replace it when it is used     stand-alone as the first path element but also wrongly when used as a mere prefix in the first element.

    Using a path like /~2/foo when accessing a server using the user dan (with home directory /home/dan) would     then quite surprisingly access the file /home/dan2/foo.

    This can be taken advantage of to circumvent filtering or worse. (CVE-2023-27534)

    The curl advisory describes this issue as follows:

    libcurl would reuse a previously created FTP connection even when one or more options had been changed     that could have made the effective user a very different one, thus leading to the doing the second     transfer with wrong credentials. (CVE-2023-27535)

    The curl advisory describes this issue as follows:

    libcurl would reuse a previously created connection even when the GSS delegation     (CURLOPT_GSSAPI_DELEGATION) option had been changed that could have changed the user's permissions in a     second transfer.

    libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of     them matches the setup. However, this GSS delegation setting was left out from the configuration match     checks, making them match too easily, affecting krb5/kerberos/negotiate/GSSAPI transfers. (CVE-2023-27536)

    The curl advisory describes this issue as follows:

    libcurl supports sharing HSTS data between separate handles. This sharing was introduced without     considerations for doing this sharing across separate threads, but there was no indication of this fact in     the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could     end up doing a double-free or use-after-free. (CVE-2023-27537)

    The curl advisory describes this issue as follows:

    libcurl would reuse a previously created connection even when an SSH related option had been changed that     should have prohibited reuse.

    libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of     them matches the setup. However, two SSH settings were left out from the configuration match checks,     making them match too easily. (CVE-2023-27538)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may     allow an attacker to pass on maliciously crafted user name and 'telnet options' during server negotiation.
    The lack of proper input scrubbing allows an attacker to send content or perform option negotiation     without the application's intent. This vulnerability could be exploited if an application allows user     input, thereby enabling attackers to execute arbitrary code on the system. (CVE-2023-27533)

  - A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to     be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as     the first element to indicate a path relative to the user's home directory. Attackers can exploit this     flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a     server with a specific user. (CVE-2023-27534)

  - An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that     can result in wrong credentials being used during subsequent transfers. Previously created connections are     kept in a connection pool for reuse if they match the current setup. However, certain FTP settings such as     CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC, and CURLOPT_USE_SSL were not     included in the configuration match checks, causing them to match too easily. This could lead to libcurl     using the wrong credentials when performing a transfer, potentially allowing unauthorized access to     sensitive information. (CVE-2023-27535)

  - An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can     reuse previously established connections with incorrect user permissions due to a failure to check for     changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI     transfers and could potentially result in unauthorized access to sensitive information. The safest option     is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed. (CVE-2023-27536)

  - An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously     established SSH connection despite the fact that an SSH option was modified, which should have prevented     reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent transfers if     the configurations match. However, two SSH settings were omitted from the configuration check, allowing     them to match easily, potentially leading to the reuse of an inappropriate connection. (CVE-2023-27538)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to     be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as     the first element to indicate a path relative to the user's home directory. Attackers can exploit this     flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a     server with a specific user. (CVE-2023-27534)

  - An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that     can result in wrong credentials being used during subsequent transfers. Previously created connections are     kept in a connection pool for reuse if they match the current setup. However, certain FTP settings such as     CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC, and CURLOPT_USE_SSL were not     included in the configuration match checks, causing them to match too easily. This could lead to libcurl     using the wrong credentials when performing a transfer, potentially allowing unauthorized access to     sensitive information. (CVE-2023-27535)

  - An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can     reuse previously established connections with incorrect user permissions due to a failure to check for     changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI     transfers and could potentially result in unauthorized access to sensitive information. The safest option     is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed. (CVE-2023-27536)

  - An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously     established SSH connection despite the fact that an SSH option was modified, which should have prevented     reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent transfers if     the configurations match. However, two SSH settings were omitted from the configuration check, allowing     them to match easily, potentially leading to the reuse of an inappropriate connection. (CVE-2023-27538)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6679 advisory.

    The curl packages provide the libcurl library and the curl utility for downloading files from servers     using various protocols, including HTTP, FTP, and LDAP.

    Security Fix(es):

    * curl: GSS delegation too eager connection re-use (CVE-2023-27536)

    * curl: TELNET option IAC injection (CVE-2023-27533)

    * curl: SFTP path ~ resolving discrepancy (CVE-2023-27534)

    * curl: SSH connection too eager reuse still (CVE-2023-27538)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-6679 advisory.

    - unify the upload/method handling (CVE-2023-28322)
    - fix host name wildcard checking (CVE-2023-28321)
    - adapt the fix of CVE-2023-27535 for RHEL 9 curl
    - fix SSH connection too eager reuse still (CVE-2023-27538)
    - fix GSS delegation too eager connection re-use (CVE-2023-27536)
    - fix FTP too eager connection reuse (CVE-2023-27535)
    - fix SFTP path ~ resolving discrepancy (CVE-2023-27534)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the curl package has been released.

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:0494-1 advisory.

    - CVE-2023-27534: Regression fix for SFTP path ~ resolving discrepancy (bsc#1219273)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
173417	Fedora 37 : curl (2023-2884ba1528)	Nessus	Fedora Local Security Checks	3/26/2023	11/14/2024	high
173452	SUSE SLED15: curl / libcurl-devel / libcurl-devel-32bit / libcurl4 / etc (SUSE-SU-2023:1582-1)	Nessus	SuSE Local Security Checks	3/28/2023	6/26/2026	high
176044	SUSE SLES12 Security Update : curl (SUSE-SU-2023:2228-1)	Nessus	SuSE Local Security Checks	5/18/2023	6/25/2026	high
176939	Amazon Linux 2 : curl (ALAS-2023-2070)	Nessus	Amazon Linux Local Security Checks	6/8/2023	12/11/2024	high
176991	EulerOS 2.0 SP8 : curl (EulerOS-SA-2023-2188)	Nessus	Huawei Local Security Checks	6/8/2023	6/8/2023	high
178059	EulerOS 2.0 SP9 : curl (EulerOS-SA-2023-2308)	Nessus	Huawei Local Security Checks	7/9/2023	7/9/2023	high
185089	RHEL 9 : curl (RHSA-2023:6679)	Nessus	Red Hat Local Security Checks	11/7/2023	3/13/2025	high
185857	Oracle Linux 9 : curl (ELSA-2023-6679)	Nessus	Oracle Linux Local Security Checks	11/16/2023	9/9/2025	high
203326	Photon OS 4.0: Curl PHSA-2023-4.0-0371	Nessus	PhotonOS Local Security Checks	7/23/2024	7/23/2024	high
299044	SUSE SLES12: curl / libcurl-devel / libcurl4 / libcurl4-32bit / libnghttp2-14 / etc (SUSE-SU-2026:0494-1)	Nessus	SuSE Local Security Checks	2/14/2026	6/26/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high