The remote NewStart CGSL host, running version MAIN 6.02, has curl packages installed that are affected by multiple vulnerabilities:

  - curl 7.1.1 to and including 7.75.0 is vulnerable to an Exposure of Private Personal Information to an     Unauthorized Actor by leaking credentials in the HTTP Referer: header. libcurl does not strip off user     credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing     HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second     HTTP request. (CVE-2021-22876)

  - curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as     `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a     flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized     data from a stack based buffer to the server, resulting in potentially revealing sensitive internal     information to the server using a clear-text network protocol. (CVE-2021-22898)

  - curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used     option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for     sending `NEW_ENV` variables, libcurlcould be made to pass on uninitialized data from a stack based buffer     to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-     text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing     the string provided by the application. (CVE-2021-22925)

  - An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow     reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated     with the same credentials as set for this transfer. This affects SASL-enabled protocols: SMPTP(S),     IMAP(S), POP3(S) and LDAP(S) (openldap only). (CVE-2022-22576)

  - An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are     affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with     authentication could leak credentials to other services that exist on different protocols or port numbers.
    (CVE-2022-27774)

  - A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or     cookie header data on HTTP redirects to the same host but another port number. (CVE-2022-27776)

  - libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed     that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for     subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were     left out from the configuration match checks, making themmatch too easily. (CVE-2022-27782)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for curl fixes the following issues :

  - CVE-2021-22890: TLS 1.3 session ticket proxy host mixup     (bsc#1183934)

  - CVE-2021-22876: Automatic referer leaks credentials     (bsc#1183933)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - curl 7.63.0 to and including 7.75.0 includes     vulnerability that allows a malicious HTTPS proxy to     MITM a connection due to bad handling of TLS 1.3     session tickets. When using a HTTPS proxy and TLS 1.3,     libcurl can confuse session tickets arriving from the     HTTPS proxy but work as if they arrived from the remote     server and then wrongly(CVE-2021-22890)

  - curl 7.1.1 to and including 7.75.0 is vulnerable to an     'Exposure of Private Personal Information to an     Unauthorized Actor' by leaking credentials in the HTTP     Referer: header. libcurl does not strip off user     credentials from the URL when automatically populating     the Referer: HTTP request header field in outgoing HTTP     requests, and therefore risks leaking sensitive data to     the server that is the target of the second HTTP     request.(CVE-2021-22876)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:1354 advisory.

    .NET Core is a managed-software framework. It implements a subset of the .NET framework APIs and several     new APIs, and it includes a CLR implementation.

    Security Fix(es):

    * curl: Leak of authentication credentials in URL via automatic Referer (CVE-2021-22876)

    * curl: Bad connection reuse due to flawed path name checks (CVE-2021-22924)

    * curl: Requirement to use TLS not properly enforced for IMAP, POP3, and FTP protocols (CVE-2021-22946)

    * curl: Server responses received before STARTTLS processed after TLS handshake (CVE-2021-22947)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple vulnerabilities were discovered in cURL, an URL transfer library :

  - CVE-2020-8169     Marek Szlagor reported that libcurl could be tricked     into prepending a part of the password to the host name     before it resolves it, potentially leaking the partial     password over the network and to the DNS server(s).

  - CVE-2020-8177     sn reported that curl could be tricked by a malicious     server into overwriting a local file when using the -J     (--remote-header-name) and -i (--include) options in the     same command line.

  - CVE-2020-8231     Marc Aldorasi reported that libcurl might use the wrong     connection when an application using libcurl's multi API     sets the option CURLOPT_CONNECT_ONLY, which could lead     to information leaks.

  - CVE-2020-8284     Varnavas Papaioannou reported that a malicious server     could use the PASV response to trick curl into     connecting back to an arbitrary IP address and port,     potentially making curl extract information about     services that are otherwise private and not disclosed.

  - CVE-2020-8285     xnynx reported that libcurl could run out of stack space     when using the FTP wildcard matching functionality     (CURLOPT_CHUNK_BGN_FUNCTION).

  - CVE-2020-8286     It was reported that libcurl didn't verify that an OCSP     response actually matches the certificate it is intended     to.

  - CVE-2021-22876     Viktor Szakats reported that libcurl does not strip off     user credentials from the URL when automatically     populating the Referer HTTP request header field in     outgoing HTTP requests.

  - CVE-2021-22890     Mingtao Yang reported that, when using an HTTPS proxy     and TLS 1.3, libcurl could confuse session tickets     arriving from the HTTPS proxy as if they arrived from     the remote server instead. This could allow an HTTPS     proxy to trick libcurl into using the wrong session     ticket for the host and thereby circumvent the server     TLS certificate check.

Daniel Stenberg reports :

libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.

libcurl automatically sets the Referer: HTTP request header field in outgoing HTTP requests if the CURLOPT_AUTOREFERER option is set. With the curl tool, it is enabled with --referer ';auto'.

The version of Junos OS installed on the remote host is affected by multiple vulnerabilities as referenced in the JSA11289 advisory.

  - curl 7.1.1 to and including 7.75.0 is vulnerable to an Exposure of Private Personal Information to an     Unauthorized Actor by leaking credentials in the HTTP Referer: header. libcurl does not strip off user     credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing     HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second     HTTP request. (CVE-2021-22876)

  - curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a     connection due to bad handling of TLS 1.3 session tickets. When using a HTTPS proxy and TLS 1.3, libcurl     can confuse session tickets arriving from the HTTPS proxy but work as if they arrived from the remote     server and then wrongly short-cut the host handshake. When confusing the tickets, a HTTPS proxy can     trick libcurl to use the wrong session ticket resume for the host and thereby circumvent the server TLS     certificate check and make a MITM attack to be possible to perform unnoticed. Note that such a malicious     HTTPS proxy needs to provide a certificate that curl will accept for the MITMed server for an attack to     work - unless curl has been told to ignore the server certificate check. (CVE-2021-22890)

  - curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the     code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected     cipher set was stored in a single static variable in the library, which has the surprising side-effect     that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will     accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport     security significantly. (CVE-2021-22897)

  - curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as     `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a     flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized     data from a stack based buffer to the server, resulting in potentially revealing sensitive internal     information to the server using a clear-text network protocol. (CVE-2021-22898)

  - curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory     being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use this in     rare unfortunate circumstances to potentially reach remote code execution in the client. When libcurl at     run-time sets up support for TLS 1.3 session tickets on a connection using OpenSSL, it stores pointers to     the transfer in-memory object for later retrieval when a session ticket arrives. If the connection is used     by multiple transfers (like with a reused HTTP/1.1 connection or multiplexed HTTP/2 connection) that first     transfer object might be freed before the new session is established on that connection and then the     function will access a memory buffer that might be freed. When using that memory, libcurl might even call     a function pointer in the object, making it possible for a remote code execution if the server could     somehow manage to get crafted memory content into the correct place in memory. (CVE-2021-22901)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the curl package has been released.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:4511 advisory.

    The curl packages provide the libcurl library and the curl utility for downloading files from servers     using various protocols, including HTTP, FTP, and LDAP.

    Security Fix(es):

    * curl: Leak of authentication credentials in URL via automatic Referer (CVE-2021-22876)

    * curl: TELNET stack contents disclosure (CVE-2021-22898)

    * curl: Incorrect fix for CVE-2021-22898 TELNET stack contents disclosure (CVE-2021-22925)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of curl installed on the remote host is prior to 7.61.1-12.98. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1509 advisory.

    It was discovered that libcurl did not remove authentication credentials from URLs when automatically     populating the Referer HTTP request header while handling HTTP redirects. This could lead to exposure of     the credentials to the server to which requests were redirected. (CVE-2021-22876)

    A vulnerability was found in curl where a flaw in the option parser for sending NEW_ENV variables libcurl     can pass uninitialized data from a stack-based buffer to the server. This issue leads to potentially     revealing sensitive internal information to the server using a clear-text network protocol. The highest     threat from this vulnerability is to confidentiality. (CVE-2021-22898)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:4511 advisory.

  - curl 7.1.1 to and including 7.75.0 is vulnerable to an Exposure of Private Personal Information to an     Unauthorized Actor by leaking credentials in the HTTP Referer: header. libcurl does not strip off user     credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing     HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second     HTTP request. (CVE-2021-22876)

  - curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as     `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a     flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized     data from a stack based buffer to the server, resulting in potentially revealing sensitive internal     information to the server using a clear-text network protocol. (CVE-2021-22898)

  - curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used     option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for     sending `NEW_ENV` variables, libcurlcould be made to pass on uninitialized data from a stack based buffer     to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-     text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing     the string provided by the application. (CVE-2021-22925)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4898-1 advisory.

    Viktor Szakats discovered that curl did not strip off user credentials from referrer header fields. A     remote attacker could possibly use this issue to obtain sensitive information. (CVE-2021-22876)

    Mingtao Yang discovered that curl incorrectly handled session tickets when using an HTTPS proxy. A remote     attacker in control of an HTTPS proxy could use this issue to bypass certificate checks and intercept     communications. This issue only affected Ubuntu 20.04 LTS and Ubuntu 20.10. (CVE-2021-22890)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
187340	NewStart CGSL MAIN 6.02 : curl Multiple Vulnerabilities (NS-SA-2023-0071)	Nessus	NewStart CGSL Local Security Checks	2023/12/27	2024/1/2	high
148321	openSUSE Security Update : curl (openSUSE-2021-510)	Nessus	SuSE Local Security Checks	2021/4/6	2024/1/5	medium
151262	EulerOS 2.0 SP9 : curl (EulerOS-SA-2021-2049)	Nessus	Huawei Local Security Checks	2021/7/1	2023/12/11	medium
159727	RHEL 7 : rh-dotnet31-curl (RHSA-2022:1354)	Nessus	Red Hat Local Security Checks	2022/4/14	2024/11/7	critical
148277	Debian DSA-4881-1 : curl - security update	Nessus	Debian Local Security Checks	2021/4/1	2024/1/16	high
148519	FreeBSD : curl -- Automatic referer leaks credentials (b1194286-958e-11eb-9c34-080027f515ea)	Nessus	FreeBSD Local Security Checks	2021/4/14	2024/1/4	medium
156677	Juniper Junos OS Multiple Vulnerabilities (JSA11289)	Nessus	Junos Local Security Checks	2022/1/12	2023/11/21	high
148356	Photon OS 4.0: Curl PHSA-2021-4.0-0007	Nessus	PhotonOS Local Security Checks	2021/4/7	2025/8/22	medium
155192	RHEL 8 : curl (RHSA-2021:4511)	Nessus	Red Hat Local Security Checks	2021/11/11	2025/3/15	medium
151508	Amazon Linux AMI : curl (ALAS-2021-1509)	Nessus	Amazon Linux Local Security Checks	2021/7/13	2024/12/11	medium
157529	AlmaLinux 8 : curl (ALSA-2021:4511)	Nessus	Alma Linux Local Security Checks	2022/2/9	2023/11/13	medium
148340	Photon OS 2.0: Curl PHSA-2021-2.0-0334	Nessus	PhotonOS Local Security Checks	2021/4/7	2024/7/22	medium
148260	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : curl vulnerabilities (USN-4898-1)	Nessus	Ubuntu Local Security Checks	2021/4/1	2025/9/3	medium

检测

插件搜索

high

medium

medium

critical

high

medium

high

medium

medium

medium

medium

medium

medium