The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-cab5c9befb advisory.

  - curl 7.1.1 to and including 7.75.0 is vulnerable to an Exposure of Private Personal Information to an     Unauthorized Actor by leaking credentials in the HTTP Referer: header. libcurl does not strip off user     credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing     HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second     HTTP request. (CVE-2021-22876)

  - curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a     connection due to bad handling of TLS 1.3 session tickets. When using a HTTPS proxy and TLS 1.3, libcurl     can confuse session tickets arriving from the HTTPS proxy but work as if they arrived from the remote     server and then wrongly short-cut the host handshake. When confusing the tickets, a HTTPS proxy can     trick libcurl to use the wrong session ticket resume for the host and thereby circumvent the server TLS     certificate check and make a MITM attack to be possible to perform unnoticed. Note that such a malicious     HTTPS proxy needs to provide a certificate that curl will accept for the MITMed server for an attack to     work - unless curl has been told to ignore the server certificate check. (CVE-2021-22890)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - curl 7.63.0 to and including 7.75.0 includes     vulnerability that allows a malicious HTTPS proxy to     MITM a connection due to bad handling of TLS 1.3     session tickets. When using a HTTPS proxy and TLS 1.3,     libcurl can confuse session tickets arriving from the     HTTPS proxy but work as if they arrived from the remote     server and then wrongly(CVE-2021-22890)

  - curl 7.1.1 to and including 7.75.0 is vulnerable to an     'Exposure of Private Personal Information to an     Unauthorized Actor' by leaking credentials in the HTTP     Referer: header. libcurl does not strip off user     credentials from the URL when automatically populating     the Referer: HTTP request header field in outgoing HTTP     requests, and therefore risks leaking sensitive data to     the server that is the target of the second HTTP     request.(CVE-2021-22876)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2023-0808 advisory.

  - The go command may execute arbitrary code at build time when using cgo. This may occur when running go     get on a malicious module, or when running any other command which builds untrusted code. This is can by     triggered by linker flags, specified via a #cgo LDFLAGS directive. Flags containing embedded spaces are     mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in     the argument of another flag. This only affects usage of the gccgo compiler. (CVE-2023-29405)

  - When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by     finalizing the operation with a rename from a temporary name to the final target file name.In that rename     operation, it might accidentally *widen* the permissions for the target file, leaving the updated file     accessible to more users than intended. (CVE-2022-32207)

  - decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS. (CVE-2022-38900)

  - The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.
    (CVE-2022-33987)

  - Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the     name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3. (CVE-2022-37601)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

New curl packages are available for Slackware 14.0, 14.1, 14.2, and
-current to fix security issues.

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - curl 7.63.0 to and including 7.75.0 includes     vulnerability that allows a malicious HTTPS proxy to     MITM a connection due to bad handling of TLS 1.3     session tickets. When using a HTTPS proxy and TLS 1.3,     libcurl can confuse session tickets arriving from the     HTTPS proxy but work as if they arrived from the remote     server and then wrongly(CVE-2021-22890)

  - curl 7.1.1 to and including 7.75.0 is vulnerable to an     'Exposure of Private Personal Information to an     Unauthorized Actor' by leaking credentials in the HTTP     Referer: header. libcurl does not strip off user     credentials from the URL when automatically populating     the Referer: HTTP request header field in outgoing HTTP     requests, and therefore risks leaking sensitive data to     the server that is the target of the second HTTP     request(CVE-2021-22876)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202105-36 (cURL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in cURL. Please review the       CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

On March 31, 2021, curl published security updates addressing CVE-2021-22876 and CVE-2021-22890. Previous releases of Puppet Agent contain a vulnerable version of curl. For more information about this vulnerability, refer to the curl security announcements.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2472 advisory.

    This release adds the new Apache HTTP Server 2.4.37 Service Pack 8 packages that are part of the JBoss     Core Services offering.

    This release serves as a replacement for Red Hat JBoss Core Services Pack Apache Server 2.4.37 Service     Pack 7 and includes bug fixes and enhancements. Refer to the Release Notes for information on the most     significant bug fixes and enhancements included in this release.

    Security Fix(es):

    * curl: Use-after-free in TLS session handling when using OpenSSL TLS backend (CVE-2021-22901)

    * httpd: NULL pointer dereference on specially crafted HTTP/2 request (CVE-2021-31618)

    * libcurl: partial password leak over DNS on HTTP redirect (CVE-2020-8169)

    * curl: FTP PASV command response can cause curl to connect to arbitrary host (CVE-2020-8284)

    * curl: Malicious FTP server can trigger stack overflow when CURLOPT_CHUNK_BGN_FUNCTION is used     (CVE-2020-8285)

    * curl: Inferior OCSP verification (CVE-2020-8286)

    * curl: Leak of authentication credentials in URL via automatic Referer (CVE-2021-22876)

    * curl: TLS 1.3 session ticket mix-up with HTTPS proxy host (CVE-2021-22890)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
148779	Fedora 33 : curl (2021-cab5c9befb)	Nessus	Fedora Local Security Checks	2021/4/19	2024/1/3	medium
151255	EulerOS 2.0 SP9 : curl (EulerOS-SA-2021-2060)	Nessus	Huawei Local Security Checks	2021/7/1	2023/12/11	medium
194926	Universal Forwarder 8.2.0 < 8.2.12, 9.0.0 < 9.0.6, 9.1.0 < 9.1.1 (SVD-2023-0809)	Nessus	CGI abuses	2024/5/2	2024/5/30	critical
194928	Splunk Enterprise 8.2.0 < 8.2.12, 9.0.0 < 9.0.6, 9.1.0 < 9.1.1 (SVD-2023-0808)	Nessus	CGI abuses	2024/5/2	2024/7/29	critical
148274	Slackware 14.0 / 14.1 / 14.2 / current : curl (SSA:2021-090-01)	Nessus	Slackware Local Security Checks	2021/4/1	2024/1/8	medium
150264	EulerOS Virtualization 2.9.0 : curl (EulerOS-SA-2021-1969)	Nessus	Huawei Local Security Checks	2021/6/4	2023/12/27	medium
157003	GLSA-202105-36 : cURL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2022/1/24	2023/12/21	high
184145	Puppet Agent 6.x < 6.22.1 / 7.x < 7.6.1 Vulnerability	Nessus	Windows	2023/11/1	2023/11/2	medium
150852	RHEL 7 / 8 : Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP8 (RHSA-2021:2472)	Nessus	Red Hat Local Security Checks	2021/6/17	2026/5/8	high

检测

插件搜索

medium

medium

critical

critical

medium

medium

high

medium

high