The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4511 advisory.

  - curl: Leak of authentication credentials in URL via automatic Referer (CVE-2021-22876)

  - CVE-2021-22925 curl: Incorrect fix for  TELNET stack contents disclosure (CVE-2021-22898)

  - curl: Incorrect fix for CVE-2021-22898 TELNET stack contents disclosure (CVE-2021-22925)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2023-0613 advisory.

  - A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as     @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states we are in     the process of marking this report as invalid; however, some third parties takes the position that A     prototype injection/Prototype pollution is not just when global objects are polluted with recursive merge     or deep cloning but also when a target object is polluted. (CVE-2022-37616)

  - When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by     finalizing the operation with a rename from a temporary name to the final target file name.In that rename     operation, it might accidentally *widen* the permissions for the target file, leaving the updated file     accessible to more users than intended. (CVE-2022-32207)

  - An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the     XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to     access an array at a negative 2GB offset, typically leading to a segmentation fault. (CVE-2022-40303)

  - An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a     hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be     provoked. (CVE-2022-40304)

  - There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName.
    X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME     incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently     interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL     checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may     allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or     enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate     chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these     inputs, the other input must already contain an X.400 address as a CRL distribution point, which is     uncommon. As such, this vulnerability is most likely to only affect applications which have implemented     their own functionality for retrieving CRLs over a network. (CVE-2023-0286)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5894-1 advisory.

    Harry Sintonen and Tomas Hoger discovered that curl incorrectly handled TELNET connections when the -t     option was used on the command line. Uninitialized data possibly containing sensitive information could be     sent to the remote server, contrary to expectations. This issue was only fixed in Ubuntu 14.04 ESM.
    (CVE-2021-22898, CVE-2021-22925)

    It was discovered that curl incorrectly handled denials when using HTTP proxies. A remote attacker could     use this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary     code. (CVE-2022-43552)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as     `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a     flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized     data from a stack based buffer to the server, resulting in potentially revealing sensitive internal     information to the server using a clear-text network protocol. (CVE-2021-22898)

  - curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used     option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for     sending `NEW_ENV` variables, libcurlcould be made to pass on uninitialized data from a stack based buffer     to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-     text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing     the string provided by the application. (CVE-2021-22925)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLES11 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2021:14735-1 advisory.

  - To fix this vulnerability, update the affected packages: curl (CVE-2021-22898)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:1762-1 advisory.

  - curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as     `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a     flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized     data from a stack based buffer to the server, resulting in potentially revealing sensitive internal     information to the server using a clear-text network protocol. (CVE-2021-22898)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES11 / SLES_SAP11 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:14760-1 advisory.

  - curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as     `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a     flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized     data from a stack based buffer to the server, resulting in potentially revealing sensitive internal     information to the server using a clear-text network protocol. (CVE-2021-22898)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - curl is a command line tool for transferring data with     URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP,     SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMAP,     SMTP, POP3 and RTSP. curl supports SSL certificates,     HTTP POST, HTTP PUT, FTP uploading, HTTP form based     upload, proxies, cookies, user+password authentication     (Basic, Digest, NTLM, Negotiate, kerberos...), file     transfer resume, proxy tunneling and a busload of other     useful tricks.Security Fix(es):A flaw was found in curl     where libcurl lets applications specify which specific     TLS ciphers to use in transfers, using the option     called CURLOPT_SSL_CIPHER_LIST. The cipher selection is     used for the TLS negotiation when a transfer is done     involving any of the TLS based transfer protocols     libcurl sup(CVE-2021-22897)curl 7.7 through 7.76.1     suffers from an information disclosure when the `-t`     command line option, known as `CURLOPT_TELNETOPTIONS`     in libcurl, is used to send variable=content pairs to     TELNET servers. Due to a flaw in the option parser for     sending NEW_ENV variables, libcurl could be made to     pass on uninitialized data from a stack based buffer to     the server, resulting in potentially revealing     sensitive internal information to the server using a     clear-text network protocol.(CVE-2021-22898)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of curl installed on the remote host is prior to 7.61.1-12. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1653 advisory.

    It was discovered that libcurl did not remove authentication credentials from URLs when automatically     populating the Referer HTTP request header while handling HTTP redirects. This could lead to exposure of     the credentials to the server to which requests were redirected. (CVE-2021-22876)

    A vulnerability was found in curl where a flaw in the option parser for sending NEW_ENV variables libcurl     can pass uninitialized data from a stack-based buffer to the server. This issue leads to potentially     revealing sensitive internal information to the server using a clear-text network protocol. The highest     threat from this vulnerability is to confidentiality. (CVE-2021-22898)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:4511 advisory.

    The curl packages provide the libcurl library and the curl utility for downloading files from servers     using various protocols, including HTTP, FTP, and LDAP.

    Security Fix(es):

    * curl: Leak of authentication credentials in URL via automatic Referer (CVE-2021-22876)

    * curl: TELNET stack contents disclosure (CVE-2021-22898)

    * curl: Incorrect fix for CVE-2021-22898 TELNET stack contents disclosure (CVE-2021-22925)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-4511 advisory.

    - fix STARTTLS protocol injection via MITM (CVE-2021-22947)
    - fix protocol downgrade required TLS bypass (CVE-2021-22946)
    - fix TELNET stack contents disclosure again (CVE-2021-22925)
    - fix TELNET stack contents disclosure (CVE-2021-22898)
    - fix bad connection reuse due to flawed path name checks (CVE-2021-22924)
    - disable metalink support to fix the following vulnerabilities         CVE-2021-22923 - metalink download sends credentials         CVE-2021-22922 - wrong content via metalink not discarded
    - fix a cppchecks false positive in 0029-curl-7.61.1-CVE-2021-22876.patch

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the curl package has been released.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3085 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3085-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Markus Koschany     August 29, 2022                               https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : curl     Version        : 7.64.0-4+deb10u3     CVE ID         : CVE-2021-22898 CVE-2021-22924 CVE-2021-22946 CVE-2021-22947                      CVE-2022-22576 CVE-2022-27776 CVE-2022-27781 CVE-2022-27782                      CVE-2022-32206 CVE-2022-32208     Debian Bug     : 989228 991492 1010295 1010254 1010253 1010252

    Multiple security vulnerabilities have been discovered in cURL, an URL transfer     library. These flaws may allow remote attackers to obtain sensitive     information, leak authentication or cookie header data or facilitate a     denial of service attack.

    For Debian 10 buster, these problems have been fixed in version     7.64.0-4+deb10u3.

    We recommend that you upgrade your curl packages.

    For the detailed security status of curl please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/curl

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
155067	CentOS 8 : curl (CESA-2021:4511)	Nessus	CentOS Local Security Checks	2021/11/11	2023/11/24	medium
194919	Splunk Enterprise < 8.1.14, 8.2.0 < 8.2.11, 9.0.0 < 9.0.5 (SVD-2023-0613)	Nessus	CGI abuses	2024/5/2	2024/7/26	critical
194926	Universal Forwarder 8.2.0 < 8.2.12, 9.0.0 < 9.0.6, 9.1.0 < 9.1.1 (SVD-2023-0809)	Nessus	CGI abuses	2024/5/2	2024/5/30	critical
171954	Ubuntu 16.04 ESM : curl vulnerabilities (USN-5894-1)	Nessus	Ubuntu Local Security Checks	2023/2/28	2024/8/27	medium
157962	EulerOS Virtualization 3.0.6.6 : curl (EulerOS-SA-2022-1116)	Nessus	Huawei Local Security Checks	2022/2/12	2023/11/9	medium
156493	EulerOS Virtualization 3.0.2.6 : curl (EulerOS-SA-2021-2894)	Nessus	Huawei Local Security Checks	2022/1/6	2023/11/21	medium
150621	SUSE SLES11 Security Update : curl (SUSE-SU-2021:14735-1)	Nessus	SuSE Local Security Checks	2021/6/10	2023/12/26	low
151736	openSUSE 15 Security Update : curl (openSUSE-SU-2021:1762-1)	Nessus	SuSE Local Security Checks	2021/7/16	2023/12/8	low
151201	SUSE SLES11 Security Update : curl (SUSE-SU-2021:14760-1)	Nessus	SuSE Local Security Checks	2021/7/1	2023/7/13	low
152334	EulerOS 2.0 SP9 : curl (EulerOS-SA-2021-2239)	Nessus	Huawei Local Security Checks	2021/8/9	2023/12/6	medium
152337	EulerOS 2.0 SP9 : curl (EulerOS-SA-2021-2265)	Nessus	Huawei Local Security Checks	2021/8/9	2023/12/6	medium
150974	Amazon Linux 2 : curl (ALAS-2021-1653)	Nessus	Amazon Linux Local Security Checks	2021/6/23	2024/12/11	medium
155192	RHEL 8 : curl (RHSA-2021:4511)	Nessus	Red Hat Local Security Checks	2021/11/11	2025/3/15	medium
155433	Oracle Linux 8 : curl (ELSA-2021-4511)	Nessus	Oracle Linux Local Security Checks	2021/11/17	2024/10/22	medium
150039	Photon OS 3.0: Curl PHSA-2021-3.0-0243	Nessus	PhotonOS Local Security Checks	2021/5/28	2025/8/22	high
150042	Photon OS 4.0: Curl PHSA-2021-4.0-0033	Nessus	PhotonOS Local Security Checks	2021/5/28	2025/8/22	high
194927	Universal Forwarders < 8.1.14, 8.2.0 < 8.2.11, 9.0.0 < 9.0.5 (SVD-2023-0614)	Nessus	CGI abuses	2024/5/2	2024/5/30	critical
164482	Debian dla-3085 : curl - security update	Nessus	Debian Local Security Checks	2022/8/29	2025/1/22	critical

检测

插件搜索

medium

critical

critical

medium

medium

medium

low

low

low

medium

medium

medium

medium

medium

high

high

critical

critical