The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the curl-7.76.1-26.el9 build changelog.

  - A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may     allow an attacker to pass on maliciously crafted user name and telnet options during server negotiation.
    The lack of proper input scrubbing allows an attacker to send content or perform option negotiation     without the application's intent. This vulnerability could be exploited if an application allows user     input, thereby enabling attackers to execute arbitrary code on the system. (CVE-2023-27533)

  - A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to     be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as     the first element to indicate a path relative to the user's home directory. Attackers can exploit this     flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a     server with a specific user. (CVE-2023-27534)

  - An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that     can result in wrong credentials being used during subsequent transfers. Previously created connections are     kept in a connection pool for reuse if they match the current setup. However, certain FTP settings such as     CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC, and CURLOPT_USE_SSL were not     included in the configuration match checks, causing them to match too easily. This could lead to libcurl     using the wrong credentials when performing a transfer, potentially allowing unauthorized access to     sensitive information. (CVE-2023-27535)

  - An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can     reuse previously established connections with incorrect user permissions due to a failure to check for     changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI     transfers and could potentially result in unauthorized access to sensitive information. The safest option     is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed. (CVE-2023-27536)

  - An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously     established SSH connection despite the fact that an SSH option was modified, which should have prevented     reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent transfers if     the configurations match. However, two SSH settings were omitted from the configuration check, allowing     them to match easily, potentially leading to the reuse of an inappropriate connection. (CVE-2023-27538)

  - An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of     wildcard patterns when listed as Subject Alternative Name in TLS server certificates. curl can be built     to use its own name matching function for TLS rather than one provided by a TLS library. This private     wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a     result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before     used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to     pattern match, but the wildcard check in curl could still check for `x*`, which would match even though     the IDN name most likely contained nothing even resembling an `x`. (CVE-2023-28321)

  - An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might     erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the     `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request     which used that callback. This flaw may surprise the application and cause it to misbehave and either send     off the wrong data or use memory after free or similar in the second transfer. The problem exists in the     logic for a reused handle when it is (expected to be) changed from a PUT to a POST. (CVE-2023-28322)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0865-1 advisory.

    - CVE-2023-27533: Fixed TELNET option IAC injection (bsc#1209209).
    - CVE-2023-27534: Fixed SFTP path ~ resolving discrepancy (bsc#1209210).
    - CVE-2023-27535: Fixed FTP too eager connection reuse (bsc#1209211).
    - CVE-2023-27536: Fixed GSS delegation too eager connection reuse (bsc#1209212).
    - CVE-2023-27538: Fixed SSH connection too eager reuse still (bsc#1209214).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-0de03a9232 advisory.

    - fix SSH connection too eager reuse still (CVE-2023-27538)
    - fix HSTS double-free (CVE-2023-27537)
    - fix GSS delegation too eager connection re-use (CVE-2023-27536)
    - fix FTP too eager connection reuse (CVE-2023-27535)
    - fix SFTP path ~ resolving discrepancy (CVE-2023-27534)
    - fix TELNET option IAC injection (CVE-2023-27533)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-7e7414e64d advisory.

    - fix SSH connection too eager reuse still (CVE-2023-27538)
    - fix GSS delegation too eager connection re-use (CVE-2023-27536)
    - fix FTP too eager connection reuse (CVE-2023-27535)
    - fix SFTP path ~ resolving discrepancy (CVE-2023-27534)
    - fix TELNET option IAC injection (CVE-2023-27533)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3398 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3398-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Markus Koschany     April 21, 2023                                https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : curl     Version        : 7.64.0-4+deb10u6     CVE ID         : CVE-2023-27533 CVE-2023-27535 CVE-2023-27536 CVE-2023-27538

    Several security vulnerabilities have been found in cURL, an easy-to-use     client-side URL transfer library.

    CVE-2023-27533

        A vulnerability in input validation exists in curl during         communication using the TELNET protocol may allow an attacker to pass on         maliciously crafted user name and telnet options during server         negotiation. The lack of proper input scrubbing allows an attacker to send         content or perform option negotiation without the application's intent.
        This vulnerability could be exploited if an application allows user input,         thereby enabling attackers to execute arbitrary code on the system.

    CVE-2023-27535

        An authentication bypass vulnerability exists in libcurl in the FTP         connection reuse feature that can result in wrong credentials being used         during subsequent transfers. Previously created connections are kept in a         connection pool for reuse if they match the current setup. However, certain         FTP settings such as CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER,         CURLOPT_FTP_SSL_CCC, and CURLOPT_USE_SSL were not included in the         configuration match checks, causing them to match too easily. This could         lead to libcurl using the wrong credentials when performing a transfer,         potentially allowing unauthorized access to sensitive information.

    CVE-2023-27536

        An authentication bypass vulnerability exists in libcurl in the         connection reuse feature which can reuse previously established connections         with incorrect user permissions due to a failure to check for changes in         the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects         krb5/kerberos/negotiate/GSSAPI transfers and could potentially result in         unauthorized access to sensitive information. The safest option is to not         reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed.

    CVE-2023-27538

        An authentication bypass vulnerability exists in libcurl where it         reuses a previously established SSH connection despite the fact that an SSH         option was modified, which should have prevented reuse. libcurl maintains a         pool of previously used connections to reuse them for subsequent transfers         if the configurations match. However, two SSH settings were omitted from         the configuration check, allowing them to match easily, potentially leading         to the reuse of an inappropriate connection.

    For Debian 10 buster, these problems have been fixed in version     7.64.0-4+deb10u6.

    We recommend that you upgrade your curl packages.

    For the detailed security status of curl please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/curl

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2023-0808 advisory.

  - The go command may execute arbitrary code at build time when using cgo. This may occur when running go     get on a malicious module, or when running any other command which builds untrusted code. This is can by     triggered by linker flags, specified via a #cgo LDFLAGS directive. Flags containing embedded spaces are     mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in     the argument of another flag. This only affects usage of the gccgo compiler. (CVE-2023-29405)

  - When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by     finalizing the operation with a rename from a temporary name to the final target file name.In that rename     operation, it might accidentally *widen* the permissions for the target file, leaving the updated file     accessible to more users than intended. (CVE-2022-32207)

  - decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS. (CVE-2022-38900)

  - The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.
    (CVE-2022-33987)

  - Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the     name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3. (CVE-2022-37601)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
191296	CentOS 9 : curl-7.76.1-26.el9	Nessus	CentOS Local Security Checks	2/29/2024	4/26/2024	high
173201	SUSE SLES12 Security Update : curl (SUSE-SU-2023:0865-1)	Nessus	SuSE Local Security Checks	3/22/2023	6/26/2026	high
173615	Fedora 38 : curl (2023-0de03a9232)	Nessus	Fedora Local Security Checks	3/28/2023	11/14/2024	high
174032	Fedora 36 : curl (2023-7e7414e64d)	Nessus	Fedora Local Security Checks	4/9/2023	11/14/2024	high
174685	Debian dla-3398 : curl - security update	Nessus	Debian Local Security Checks	4/25/2023	1/22/2025	high
194926	Universal Forwarder 8.2.0 < 8.2.12, 9.0.0 < 9.0.6, 9.1.0 < 9.1.1 (SVD-2023-0809)	Nessus	CGI abuses	5/2/2024	5/30/2024	critical
194928	Splunk Enterprise 8.2.0 < 8.2.12, 9.0.0 < 9.0.6, 9.1.0 < 9.1.1 (SVD-2023-0808)	Nessus	CGI abuses	5/2/2024	7/29/2024	critical

Detections

Analytics

Plugins Search

high

high

high

high

high

critical

critical