The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the a4f8bb03-f52f-11ed-9859-080027083a05 advisory.

  - The vulnerability exists due to a use-after-free error when checking the SSH sha256 fingerprint. A remote     attacker can use the application to connect to a malicious SSH server, trigger a use-after-free error and     gain access to potentially sensitive information. (CVE-2023-28319)

  - The vulnerability exists due to improper synchronization when resolving host names using the alarm() and     siglongjmp() function. A remote attacker can force the application to crash by influencing contents of the     global buffer. (CVE-2023-28320)

  - The vulnerability exists due to improper certificate validation when matching wildcards in TLS     certificates for IDN names. A remote attacker crate a specially crafted certificate that will be     considered trusted by the library. (CVE-2023-28321)

  - The vulnerability exists due to a logic error when sending HTTP POST and PUT requests using the same     handle. The libcurl can erroneously use the read callback (CURLOPT_READFUNCTION) to ask for data to send,     even when the CURLOPT_POSTFIELDS option has been set, if the same handle previously was used to issue a     PUT request which used that callback. As a result, the application can misbehave and either send off the     wrong data or use memory after free or similar in the second transfer. (CVE-2023-28322)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2224-2 advisory.

  - A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH     server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the     fingerprint before it returns an error message containing the (now freed) hash. This flaw risks inserting     sensitive heap-based data into the error message that might be shown to users or otherwise get leaked and     revealed. (CVE-2023-28319)

  - A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different     backends for resolving host names, selected at build time. If it is built to use the synchronous resolver,     it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this,     libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore     crash or otherwise misbehave. (CVE-2023-28320)

  - An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of     wildcard patterns when listed as Subject Alternative Name in TLS server certificates. curl can be built     to use its own name matching function for TLS rather than one provided by a TLS library. This private     wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a     result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before     used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to     pattern match, but the wildcard check in curl could still check for `x*`, which would match even though     the IDN name most likely contained nothing even resembling an `x`. (CVE-2023-28321)

  - An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might     erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the     `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request     which used that callback. This flaw may surprise the application and cause it to misbehave and either send     off the wrong data or use memory after free or similar in the second transfer. The problem exists in the     logic for a reused handle when it is (expected to be) changed from a PUT to a POST. (CVE-2023-28322)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the curl package has been released.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:4523 advisory.

  - An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can     reuse previously established connections with incorrect user permissions due to a failure to check for     changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI     transfers and could potentially result in unauthorized access to sensitive information. The safest option     is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed. (CVE-2023-27536)

  - An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of     wildcard patterns when listed as Subject Alternative Name in TLS server certificates. curl can be built     to use its own name matching function for TLS rather than one provided by a TLS library. This private     wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a     result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before     used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to     pattern match, but the wildcard check in curl could still check for `x*`, which would match even though     the IDN name most likely contained nothing even resembling an `x`. (CVE-2023-28321)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the curl-7.76.1-26.el9 build changelog.

  - A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may     allow an attacker to pass on maliciously crafted user name and telnet options during server negotiation.
    The lack of proper input scrubbing allows an attacker to send content or perform option negotiation     without the application's intent. This vulnerability could be exploited if an application allows user     input, thereby enabling attackers to execute arbitrary code on the system. (CVE-2023-27533)

  - A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to     be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as     the first element to indicate a path relative to the user's home directory. Attackers can exploit this     flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a     server with a specific user. (CVE-2023-27534)

  - An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that     can result in wrong credentials being used during subsequent transfers. Previously created connections are     kept in a connection pool for reuse if they match the current setup. However, certain FTP settings such as     CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC, and CURLOPT_USE_SSL were not     included in the configuration match checks, causing them to match too easily. This could lead to libcurl     using the wrong credentials when performing a transfer, potentially allowing unauthorized access to     sensitive information. (CVE-2023-27535)

  - An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can     reuse previously established connections with incorrect user permissions due to a failure to check for     changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI     transfers and could potentially result in unauthorized access to sensitive information. The safest option     is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed. (CVE-2023-27536)

  - An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously     established SSH connection despite the fact that an SSH option was modified, which should have prevented     reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent transfers if     the configurations match. However, two SSH settings were omitted from the configuration check, allowing     them to match easily, potentially leading to the reuse of an inappropriate connection. (CVE-2023-27538)

  - An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of     wildcard patterns when listed as Subject Alternative Name in TLS server certificates. curl can be built     to use its own name matching function for TLS rather than one provided by a TLS library. This private     wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a     result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before     used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to     pattern match, but the wildcard check in curl could still check for `x*`, which would match even though     the IDN name most likely contained nothing even resembling an `x`. (CVE-2023-28321)

  - An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might     erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the     `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request     which used that callback. This flaw may surprise the application and cause it to misbehave and either send     off the wrong data or use memory after free or similar in the second transfer. The problem exists in the     logic for a reused handle when it is (expected to be) changed from a PUT to a POST. (CVE-2023-28322)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of IBM Engineering Requirements Management DOORS (formerly IBM Rational DOORS) installed on the remote host is 9.7.2.x prior to 9.7.2.8. It is, therefore, affected by multiple vulnerabilities as referenced in the 7124058 advisory.

  - Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet     containers. Applications using RegExPatternMatcher with `.` in the regular expression are possibly     vulnerable to an authorization bypass. (CVE-2022-32532)

  - The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow     a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary     shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client     or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade     both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.
    (CVE-2023-46604)

  - Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be     exploited. There is only a risk in conjunction with Java object deserialization within an application. In     such situations, it allows attackers to erase contents of arbitrary files, make network connections, or     possibly run arbitrary code (specifically, Function0 functions) via a gadget chain. (CVE-2022-36944)

  - IBM Engineering Requirements Management DOORS 9.7.2.7 is vulnerable to cross-site request forgery which     could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the     website trusts. IBM X-Force ID: 251216. (CVE-2023-28949)

  - A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows     remote attackers to inject arbitrary web script through a crafted protected comment (with the     cke_protected syntax). (CVE-2020-9281)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is running a version of macOS / Mac OS X that is 11.x prior to 11.7.9. It is, therefore, affected by multiple vulnerabilities:

  - A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in     macOS Big Sur 11.7.9, iOS 15.7.8 and iPadOS 15.7.8, macOS Monterey 12.6.8. An app may be able to read     sensitive location information. (CVE-2023-40442)

  - The issue was addressed with improved memory handling. This issue is fixed in watchOS 9.6, macOS Monterey     12.6.8, iOS 15.7.8 and iPadOS 15.7.8, macOS Big Sur 11.7.9, iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5.
    An app may be able to execute arbitrary code with kernel privileges. (CVE-2023-34425)

  - A logic issue was addressed with improved restrictions. This issue is fixed in macOS Ventura 13.5. A     sandboxed process may be able to circumvent sandbox restrictions. (CVE-2023-32364)

  - This issue was addressed with improved data protection. This issue is fixed in macOS Monterey 12.6.8,     macOS Ventura 13.5, macOS Big Sur 11.7.9. An app may be able to modify protected parts of the file system.
    (CVE-2023-35983)

  - A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in     macOS Ventura 13.5. An app may be able to read sensitive location information. (CVE-2023-40392)

  - OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like     operating systems. Starting in version 2.0.0 and prior to version 2.4.6, CUPS logs data of free memory to     the logging service AFTER the connection has been closed, when it should have logged the data right     before. This is a use-after-free bug that impacts the entire cupsd process. The exact cause of this issue     is the function `httpClose(con->http)` being called in `scheduler/client.c`. The problem is that httpClose     always, provided its argument is not null, frees the pointer at the end of the call, only for     cupsdLogClient to pass the pointer to httpGetHostname. This issue happens in function `cupsdAcceptClient`     if LogLevel is warn or higher and in two scenarios: there is a double-lookup for the IP Address     (HostNameLookups Double is set in `cupsd.conf`) which fails to resolve, or if CUPS is compiled with TCP     wrappers and the connection is refused by rules from `/etc/hosts.allow` and `/etc/hosts.deny`. Version     2.4.6 has a patch for this issue. (CVE-2023-34241)

  - A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH     server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the     fingerprint before it returns an error message containing the (now freed) hash. This flaw risks inserting     sensitive heap-based data into the error message that might be shown to users or otherwise get leaked and     revealed. (CVE-2023-28319)

  - A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different     backends for resolving host names, selected at build time. If it is built to use the synchronous resolver,     it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this,     libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore     crash or otherwise misbehave. (CVE-2023-28320)

  - An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of     wildcard patterns when listed as Subject Alternative Name in TLS server certificates. curl can be built     to use its own name matching function for TLS rather than one provided by a TLS library. This private     wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a     result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before     used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to     pattern match, but the wildcard check in curl could still check for `x*`, which would match even though     the IDN name most likely contained nothing even resembling an `x`. (CVE-2023-28321)

  - An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might     erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the     `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request     which used that callback. This flaw may surprise the application and cause it to misbehave and either send     off the wrong data or use memory after free or similar in the second transfer. The problem exists in the     logic for a reused handle when it is (expected to be) changed from a PUT to a POST. (CVE-2023-28322)

  - The issue was addressed with improved handling of caches. This issue is fixed in tvOS 16.3, iOS 16.3 and     iPadOS 16.3, macOS Monterey 12.6.8, macOS Big Sur 11.7.9, iOS 15.7.8 and iPadOS 15.7.8, macOS Ventura     13.2, watchOS 9.3. Processing a font file may lead to arbitrary code execution. Apple is aware of a report     that this issue may have been actively exploited against versions of iOS released before iOS 15.7.1.
    (CVE-2023-41990)

  - The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.6.8, macOS Ventura     13.5, macOS Big Sur 11.7.9. Processing a file may lead to unexpected app termination or arbitrary code     execution. (CVE-2023-32418, CVE-2023-36854)

  - A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS     Monterey 12.6.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5, watchOS     9.6. An app may be able to execute arbitrary code with kernel privileges. (CVE-2023-32381)

  - A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS     Monterey 12.6.8, iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Big Sur 11.7.9,     macOS Ventura 13.5, watchOS 9.6. An app may be able to execute arbitrary code with kernel privileges.
    (CVE-2023-32433, CVE-2023-35993)

  - The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, macOS     Ventura 13.5. A remote user may be able to cause a denial-of-service. (CVE-2023-38603)

  - A buffer overflow issue was addressed with improved memory handling. This issue is fixed in watchOS 9.6,     macOS Big Sur 11.7.9, iOS 15.7.8 and iPadOS 15.7.8, macOS Monterey 12.6.8, tvOS 16.6, iOS 16.6 and iPadOS     16.6, macOS Ventura 13.5. A remote user may be able to cause unexpected system termination or corrupt     kernel memory. (CVE-2023-38590)

  - A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 9.6,     macOS Big Sur 11.7.9, iOS 15.7.8 and iPadOS 15.7.8, macOS Monterey 12.6.8, tvOS 16.6, iOS 16.6 and iPadOS     16.6, macOS Ventura 13.5. An app may be able to execute arbitrary code with kernel privileges.
    (CVE-2023-38598)

  - An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 15.7.8 and     iPadOS 15.7.8, macOS Big Sur 11.7.9, macOS Monterey 12.6.8, macOS Ventura 13.5. An app may be able to     execute arbitrary code with kernel privileges. (CVE-2023-37285)

  - An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in watchOS     9.6, macOS Big Sur 11.7.9, iOS 15.7.8 and iPadOS 15.7.8, macOS Monterey 12.6.8, tvOS 16.6, iOS 16.6 and     iPadOS 16.6, macOS Ventura 13.5. An app may be able to execute arbitrary code with kernel privileges.
    (CVE-2023-38604)

  - This issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.6.8, iOS     15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5,     watchOS 9.6. An app may be able to modify sensitive kernel state. Apple is aware of a report that this     issue may have been actively exploited against versions of iOS released before iOS 15.7.1.
    (CVE-2023-38606)

  - The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.8, iOS     15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5,     watchOS 9.6. An app may be able to execute arbitrary code with kernel privileges. (CVE-2023-32441)

  - A path handling issue was addressed with improved validation. This issue is fixed in macOS Monterey     12.6.8, iOS 16.6 and iPadOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5, watchOS 9.6. An app may be     able to gain root privileges. (CVE-2023-38565)

  - A logic issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.6.8, iOS 16.6     and iPadOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5, watchOS 9.6. An app may be able to cause a     denial-of-service. (CVE-2023-38593)

  - This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Big Sur     11.7.9, macOS Monterey 12.6.8, macOS Ventura 13.5. An app may be able to bypass Privacy preferences.
    (CVE-2023-38571)

  - ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-     relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo     or reached via the TERMINFO or TERM environment variable. (CVE-2023-29491)

  - This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Big Sur 11.7.9,     macOS Monterey 12.6.8, macOS Ventura 13.5. An app may be able to modify protected parts of the file     system. (CVE-2023-38601)

  - A logic issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.7.9, macOS     Monterey 12.6.8, macOS Ventura 13.5. A sandboxed process may be able to circumvent sandbox restrictions.
    (CVE-2023-32444)

  - A vulnerability was found in openldap. This security flaw causes a null pointer dereference in     ber_memalloc_x() function. (CVE-2023-2953)

  - The issue was addressed with additional restrictions on the observability of app states. This issue is     fixed in macOS Big Sur 11.7.9, macOS Monterey 12.6.8, macOS Ventura 13.5. An app may be able to access SSH     passphrases. (CVE-2023-42829)

  - A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.6.8,     macOS Ventura 13.5, macOS Big Sur 11.7.9. An app may be able to access user-sensitive data.
    (CVE-2023-38259)

  - A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Monterey     12.6.8, macOS Ventura 13.5, macOS Big Sur 11.7.9. An app may be able to modify protected parts of the file     system. (CVE-2023-38602)

  - This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Big Sur 11.7.9, iOS     15.7.8 and iPadOS 15.7.8, macOS Monterey 12.6.8, macOS Ventura 13.5. An app may be able to fingerprint the     user. (CVE-2023-42831)

  - An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Monterey     12.6.8, macOS Ventura 13.5, macOS Big Sur 11.7.9. Processing a file may lead to a denial-of-service or     potentially disclose memory contents. (CVE-2023-32443)

  - A race condition was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.7.9,     macOS Monterey 12.6.8, macOS Ventura 13.5. An app may be able to gain root privileges. (CVE-2023-42832)

  - This issue was addressed by adding additional SQLite logging restrictions. This issue is fixed in iOS 16.5     and iPadOS 16.5, tvOS 16.5, macOS Ventura 13.4. An app may be able to bypass Privacy preferences.
    (CVE-2023-32422)

  - The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.5. An app may be     able to bypass Privacy preferences. (CVE-2023-32429)

  - The SMB protocol decoder in tcpdump version 4.99.3 can perform an out-of-bounds write when decoding a     crafted network packet. (CVE-2023-1801)

  - Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499. (CVE-2023-2426)

  - NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1531. (CVE-2023-2609)

  - Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532. (CVE-2023-2610)

Note that Nessus has not tested for these issues but has instead relied only on the operating system's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202310-12 (curl: Multiple Vulnerabilities)

  - A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP.
    Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP     step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypassed if the host name     in the given URL first uses IDN characters that get replaced to ASCII counterparts as part of the IDN     conversion. Like using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full     stop (U+002E) `.`. Then in a subsequent request, it does not detect the HSTS state and makes a clear text     transfer. Because it would store the info IDN encoded but look for it IDN decoded. (CVE-2022-43551)

  - A use after free vulnerability exists in curl <7.87.0. Curl can be asked to *tunnel* virtually all     protocols it supports through an HTTP proxy. HTTP proxies can (and often do) deny such tunnel operations.
    When getting denied to tunnel the specific protocols SMB or TELNET, curl would use a heap-allocated struct     after it had been freed, in its transfer shutdown code path. (CVE-2022-43552)

  - A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause     HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be     instructed to use HTTPS instead of usingan insecure clear-text HTTP step even when HTTP is provided in the     URL. ThisHSTS mechanism would however surprisingly be ignored by subsequent transferswhen done on the same     command line because the state would not be properlycarried on. (CVE-2023-23914)

  - A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause     HSTS functionality to behave incorrectly when multiple URLs are requested in parallel. Using its HSTS     support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when     HTTP is provided in the URL. This HSTS mechanism would however surprisingly fail when multiple transfers     are done in parallel as the HSTS cache file gets overwritten by the most recentlycompleted transfer. A     later HTTP-only transfer to the earlier host name would then *not* get upgraded properly to HSTS.
    (CVE-2023-23915)

  - An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the     chained HTTP compression algorithms, meaning that a server response can be compressed multiple times and     potentially with differentalgorithms. The number of acceptable links in this decompression chain     wascapped, but the cap was implemented on a per-header basis allowing a maliciousserver to insert a     virtually unlimited number of compression steps simply byusing many headers. The use of such a     decompression chain could result in a malloc bomb, making curl end up spending enormous amounts of     allocated heap memory, or trying to and returning out of memory errors. (CVE-2023-23916)

  - A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may     allow an attacker to pass on maliciously crafted user name and telnet options during server negotiation.
    The lack of proper input scrubbing allows an attacker to send content or perform option negotiation     without the application's intent. This vulnerability could be exploited if an application allows user     input, thereby enabling attackers to execute arbitrary code on the system. (CVE-2023-27533)

  - A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to     be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as     the first element to indicate a path relative to the user's home directory. Attackers can exploit this     flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a     server with a specific user. (CVE-2023-27534)

  - An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that     can result in wrong credentials being used during subsequent transfers. Previously created connections are     kept in a connection pool for reuse if they match the current setup. However, certain FTP settings such as     CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC, and CURLOPT_USE_SSL were not     included in the configuration match checks, causing them to match too easily. This could lead to libcurl     using the wrong credentials when performing a transfer, potentially allowing unauthorized access to     sensitive information. (CVE-2023-27535)

  - An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can     reuse previously established connections with incorrect user permissions due to a failure to check for     changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI     transfers and could potentially result in unauthorized access to sensitive information. The safest option     is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed. (CVE-2023-27536)

  - A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate handles.
    This sharing was introduced without considerations for do this sharing across separate threads but there     was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads     sharing the same HSTS data could end up doing a double-free or use-after-free. (CVE-2023-27537)

  - An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously     established SSH connection despite the fact that an SSH option was modified, which should have prevented     reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent transfers if     the configurations match. However, two SSH settings were omitted from the configuration check, allowing     them to match easily, potentially leading to the reuse of an inappropriate connection. (CVE-2023-27538)

  - A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH     server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the     fingerprint before it returns an error message containing the (now freed) hash. This flaw risks inserting     sensitive heap-based data into the error message that might be shown to users or otherwise get leaked and     revealed. (CVE-2023-28319)

  - A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different     backends for resolving host names, selected at build time. If it is built to use the synchronous resolver,     it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this,     libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore     crash or otherwise misbehave. (CVE-2023-28320)

  - An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of     wildcard patterns when listed as Subject Alternative Name in TLS server certificates. curl can be built     to use its own name matching function for TLS rather than one provided by a TLS library. This private     wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a     result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before     used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to     pattern match, but the wildcard check in curl could still check for `x*`, which would match even though     the IDN name most likely contained nothing even resembling an `x`. (CVE-2023-28321)

  - An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might     erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the     `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request     which used that callback. This flaw may surprise the application and cause it to misbehave and either send     off the wrong data or use memory after free or similar in the second transfer. The problem exists in the     logic for a reused handle when it is (expected to be) changed from a PUT to a POST. (CVE-2023-28322)

  - When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later     via the libcurl headers API. However, curl did not have a limit in how many or how large headers it would     accept in a response, allowing a malicious server to stream an endless series of headers and eventually     cause curl to run out of heap memory. (CVE-2023-38039)

  - CVE-2023-38545 is a heap-based buffer overflow vulnerability in the SOCKS5 proxy handshake in libcurl and     curl.  When curl is given a hostname to pass along to a SOCKS5 proxy that is greater than 255 bytes in     length, it will switch to local name resolution in order to resolve the address before passing it on to     the SOCKS5 proxy. However, due to a bug introduced in 2020, this local name resolution could fail due to a     slow SOCKS5 handshake, causing curl to pass on the hostname greater than 255 bytes in length into the     target buffer, leading to a heap overflow.  The advisory for CVE-2023-38545 gives an example exploitation     scenario of a malicious HTTPS server redirecting to a specially crafted URL. While it might seem that an     attacker would need to influence the slowness of the SOCKS5 handshake, the advisory states that server     latency is likely slow enough to trigger this bug. (CVE-2023-38545)

  -  Please review the referenced CVE identifiers for details.    Note that the risk of remote code execution     is limited to SOCKS usage.  (CVE-2023-38546)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
176134	FreeBSD : curl -- multiple vulnerabilities (a4f8bb03-f52f-11ed-9859-080027083a05)	Nessus	FreeBSD Local Security Checks	5/19/2023	7/20/2023	high
177484	openSUSE 15 Security Update : curl (SUSE-SU-2023:2224-2)	Nessus	SuSE Local Security Checks	6/22/2023	7/20/2023	high
203935	Photon OS 3.0: Curl PHSA-2023-3.0-0589	Nessus	PhotonOS Local Security Checks	7/24/2024	7/24/2024	high
190140	CentOS 8 : curl (CESA-2023:4523)	Nessus	CentOS Local Security Checks	2/8/2024	2/8/2024	medium
191296	CentOS 9 : curl-7.76.1-26.el9	Nessus	CentOS Local Security Checks	2/29/2024	4/26/2024	high
191754	IBM Engineering Requirements Management DOORS 9.7.2.x < 9.7.2.8 Multiple Vulnerabilities (7124058)	Nessus	Windows	3/8/2024	3/12/2024	critical
178754	macOS 11.x < 11.7.9 Multiple Vulnerabilities (HT213845)	Nessus	MacOS X Local Security Checks	7/24/2023	6/14/2024	critical
182879	GLSA-202310-12 : curl: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	10/11/2023	11/6/2025	critical

Detections

Analytics

Plugins Search

high

high

high

medium

high

critical

critical

critical