According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - This flaw allows a malicious HTTP server to set 'super cookies' in curl that are then passed back to more     origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get     sent to different and unrelated sites and domains. It could do this by exploiting a mixed case flaw in     curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a     cookie could be set with `domain=co.UK` when the URL used a lower case hostname `curl.co.uk`, even though     `co.uk` is listed as a PSL domain. (CVE-2023-46218)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:1129 advisory.

  - This flaw allows a malicious HTTP server to set super cookies in curl that are then passed back to more     origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get     sent to different and unrelated sites and domains. It could do this by exploiting a mixed case flaw in     curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a     cookie could be set with `domain=co.UK` when the URL used a lower case hostname `curl.co.uk`, even though     `co.uk` is listed as a PSL domain. (CVE-2023-46218)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - This flaw allows a malicious HTTP server to set 'super cookies' in curl that are then passed back to more     origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get     sent to different and unrelated sites and domains. It could do this by exploiting a mixed case flaw in     curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a     cookie could be set with `domain=co.UK` when the URL used a lower case hostname `curl.co.uk`, even though     `co.uk` is listed as a PSL domain. (CVE-2023-46218)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the curl package has been released.

The version of cmake / curl / mysql installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-46218 advisory.

  - This flaw allows a malicious HTTP server to set super cookies in curl that are then passed back to more     origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get     sent to different and unrelated sites and domains. It could do this by exploiting a mixed case flaw in     curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a     cookie could be set with `domain=co.UK` when the URL used a lower case hostname `curl.co.uk`, even though     `co.uk` is listed as a PSL domain. (CVE-2023-46218)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4659-1 advisory.

  - This flaw allows a malicious HTTP server to set super cookies in curl that are then passed back to more     origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get     sent to different and unrelated sites and domains. It could do this by exploiting a mixed case flaw in     curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a     cookie could be set with `domain=co.UK` when the URL used a lower case hostname `curl.co.uk`, even though     `co.uk` is listed as a PSL domain. (CVE-2023-46218)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of curl installed on the remote host is prior to 8.3.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2385 advisory.

    This flaw allows a malicious HTTP server to set super cookies in curl that are then passed back to more     origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get     sent to different and unrelated sites and domains.

    It could do this by exploiting a mixed case flaw in curl's function that verifies a given cookie domain     against the Public Suffix List (PSL). For example a cookie could be set with domain=co.UK when the URL     used a lowercase hostname curl.co.uk, even though co.uk is listed as a PSL domain. (CVE-2023-46218)

    When saving HSTS data to an excessively long file name, curl could end up removing all contents, making     subsequent requests using that file unaware of the HSTS status they should otherwise use. (CVE-2023-46219)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:1601 advisory.

  - An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might     erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the     `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request     which used that callback. This flaw may surprise the application and cause it to misbehave and either send     off the wrong data or use memory after free or similar in the second transfer. The problem exists in the     logic for a reused handle when it is (expected to be) changed from a PUT to a POST. (CVE-2023-28322)

  - This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the     specific series of conditions are met. libcurl performs transfers. In its API, an application creates     easy handles that are the individual handles for single transfers. libcurl provides a function call that     duplicates en easy handle called     [curl_easy_duphandle](https://curl.se/libcurl/c/curl_easy_duphandle.html). If a transfer has cookies     enabled when the handle is duplicated, the cookie-enable state is also cloned - but without cloning the     actual cookies. If the source handle did not read any cookies from a specific file on disk, the cloned     version of the handle would instead store the file name as `none` (using the four ASCII letters, no     quotes). Subsequent use of the cloned handle that does not explicitly set a source to load cookies from     would then inadvertently load cookies from a file named `none` - if such a file exists and is readable in     the current directory of the program using libcurl. And if using the correct file format of course.
    (CVE-2023-38546)

  - CVE-2023-38546 is a cookie injection vulnerability in the curl_easy_duphandle(), a function in libcurl     that duplicates easy handles.  When duplicating an easy handle, if cookies are enabled, the duplicated     easy handle will not duplicate the cookies themselves, but would instead set the filename to none.'     Therefore, when the duplicated easy handle is subsequently used, if a source was not set for the cookies,     libcurl would attempt to load them from the file named none' on the disk.  This vulnerability is rated     low, as the various conditions required for exploitation are unlikely.  (CVE-2023-38546)

  - This flaw allows a malicious HTTP server to set super cookies in curl that are then passed back to more     origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get     sent to different and unrelated sites and domains. It could do this by exploiting a mixed case flaw in     curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a     cookie could be set with `domain=co.UK` when the URL used a lower case hostname `curl.co.uk`, even though     `co.uk` is listed as a PSL domain. (CVE-2023-46218)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0355 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2023-46218:
    This flaw allows a malicious HTTP server to set super cookies in curl that     are then passed back to more origins than what is otherwise allowed or     possible. This allows a site to set cookies that then would get sent to     different and unrelated sites and domains.

    It could do this by exploiting a mixed case flaw in curl's function that     verifies a given cookie domain against the Public Suffix List (PSL). For     example a cookie could be set with `domain=co.UK` when the URL used a lower     case hostname `curl.co.uk`, even though `co.uk` is listed as a PSL domain.


    CVE-2023-46219:
    When saving HSTS data to an excessively long file name, curl could end up     removing all contents, making subsequent requests using that file unaware of     the HSTS status they should otherwise use.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to     pass along the host name to the SOCKS5 proxy to allow that to resolve the address instead of it getting     done by curl itself, the maximum length that host name can be is 255 bytes. If the host name is detected     to be longer, curl switches to local name resolving and instead passes on the resolved address only. Due     to this bug, the local variable that means 'let the host resolve the name' could get the wrong value     during a slow SOCKS5 handshake, and contrary to the intention, copy the too long host name to the target     buffer instead of copying just the resolved address there. The target buffer being a heap based buffer,     and the host name coming from the URL that curl has been told to operate with. (CVE-2023-38545)

  - CVE-2023-38545 is a heap-based buffer overflow vulnerability in the SOCKS5 proxy handshake in libcurl and     curl.  When curl is given a hostname to pass along to a SOCKS5 proxy that is greater than 255 bytes in     length, it will switch to local name resolution in order to resolve the address before passing it on to     the SOCKS5 proxy. However, due to a bug introduced in 2020, this local name resolution could fail due to a     slow SOCKS5 handshake, causing curl to pass on the hostname greater than 255 bytes in length into the     target buffer, leading to a heap overflow.  The advisory for CVE-2023-38545 gives an example exploitation     scenario of a malicious HTTPS server redirecting to a specially crafted URL. While it might seem that an     attacker would need to influence the slowness of the SOCKS5 handshake, the advisory states that server     latency is likely slow enough to trigger this bug. (CVE-2023-38545)

  - This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the     specific series of conditions are met. libcurl performs transfers. In its API, an application creates     'easy handles' that are the individual handles for single transfers. libcurl provides a function call that     duplicates en easy handle called     [curl_easy_duphandle](https://curl.se/libcurl/c/curl_easy_duphandle.html). If a transfer has cookies     enabled when the handle is duplicated, the cookie-enable state is also cloned - but without cloning the     actual cookies. If the source handle did not read any cookies from a specific file on disk, the cloned     version of the handle would instead store the file name as `none` (using the four ASCII letters, no     quotes). Subsequent use of the cloned handle that does not explicitly set a source to load cookies from     would then inadvertently load cookies from a file named `none` - if such a file exists and is readable in     the current directory of the program using libcurl. And if using the correct file format of course.
    (CVE-2023-38546)

  - CVE-2023-38546 is a cookie injection vulnerability in the curl_easy_duphandle(), a function in libcurl     that duplicates easy handles.  When duplicating an easy handle, if cookies are enabled, the duplicated     easy handle will not duplicate the cookies themselves, but would instead set the filename to none.'     Therefore, when the duplicated easy handle is subsequently used, if a source was not set for the cookies,     libcurl would attempt to load them from the file named none' on the disk.  This vulnerability is rated     low, as the various conditions required for exploitation are unlikely.  (CVE-2023-38546)

  - This flaw allows a malicious HTTP server to set 'super cookies' in curl that are then passed back to more     origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get     sent to different and unrelated sites and domains. It could do this by exploiting a mixed case flaw in     curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a     cookie could be set with `domain=co.UK` when the URL used a lower case hostname `curl.co.uk`, even though     `co.uk` is listed as a PSL domain. (CVE-2023-46218)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Tenable.ad installed on the remote host is prior to 3.59.5. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2024-11 advisory.

  - The POLY1305 MAC (message authentication code) implementation contains a bug that might     corrupt the internal state of applications on the Windows 64 platform when running on newer X86_64     processors supporting the AVX512-IFMA instructions. Impact summary: If in an application that uses the     OpenSSL library an attacker can influence whether the POLY1305 MAC algorithm is used, the application     state might be corrupted with various application dependent consequences. The POLY1305 MAC (message     authentication code) implementation in OpenSSL does not save the contents of non-volatile XMM registers on     Windows 64 platform when calculating the MAC of data larger than 64 bytes. Before returning to the caller     all the XMM registers are set to zero rather than restoring their previous content. The vulnerable code is     used only on newer x86_64 processors supporting the AVX512-IFMA instructions. The consequences of this     kind of internal application state corruption can be various - from no consequences, if the calling     application does not depend on the contents of non-volatile XMM registers at all, to the worst     consequences, where the attacker could get complete control of the application process. However given the     contents of the registers are just zeroized so the attacker cannot put arbitrary values inside, the most     likely consequence, if any, would be an incorrect result of some application dependent calculations or a     crash leading to a denial of service. The POLY1305 MAC algorithm is most frequently used as part of the     CHACHA20-POLY1305 AEAD (authenticated encryption with associated data) algorithm. The most common usage of     this AEAD cipher is with TLS protocol versions 1.2 and 1.3 and a malicious client can influence whether     this AEAD cipher is used by the server. This implies that server applications using OpenSSL can be     potentially impacted. However we are currently not aware of any concrete application that would be     affected by this issue therefore we consider this a Low severity security issue. As a workaround the     AVX512-IFMA instructions support can be disabled at runtime by setting the environment variable     OPENSSL_ia32cap: OPENSSL_ia32cap=:~0x200000 The FIPS provider is not affected by this issue.
    (CVE-2023-4807)

  - Envoy is a cloud-native, open source edge and service proxy. Envoyproxy with a Brotli filter can get into     an endless loop during decompression of Brotli data with extra input. (CVE-2024-32976)

  - Envoy is a cloud-native, open source edge and service proxy. Envoy exposed an out-of-memory (OOM) vector     from the mirror response, since async HTTP client will buffer the response with an unbounded buffer.
    (CVE-2024-34364)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to 20230302.102005. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20230302.100187 advisory.

  - A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside     the unbound group to modify the unbound runtime configuration. If a process can connect over localhost to     port 8953, it can alter the configuration of unbound.service. This flaw allows an unprivileged attacker to     manipulate a running instance, potentially altering forwarders, allowing them to track all queries     forwarded by the local resolver, and, in some cases, disrupting resolving altogether. (CVE-2024-1488)

  - Use after free in tcpslice triggers AddressSanitizer, no other confirmed impact. (CVE-2021-41043)

  - Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote     attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the     KeyTrap issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the     protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG     records. (CVE-2023-50387)

  - The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped)     allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC     responses in a random subdomain attack, aka the NSEC3 issue. The RFC 5155 specification implies that an     algorithm must perform thousands of iterations of a hash function in certain situations. (CVE-2023-50868)

  - close_altfile in filename.c in less before 606 omits shell_quote calls for LESSCLOSE. (CVE-2022-48624)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This flaw allows a malicious HTTP server to set super cookies in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains. It could do this by exploiting a mixed case flaw in curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a cookie could be set with `domain=co.UK` when the URL used a lower case hostname `curl.co.uk`, even though `co.uk` is listed as a PSL domain.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
190321	EulerOS 2.0 SP9 : curl (EulerOS-SA-2024-1172)	Nessus	Huawei Local Security Checks	2024/2/8	2024/2/8	medium
191684	AlmaLinux 9 : curl (ALSA-2024:1129)	Nessus	Alma Linux Local Security Checks	2024/3/7	2024/3/7	medium
192429	EulerOS Virtualization 2.9.0 : curl (EulerOS-SA-2024-1467)	Nessus	Huawei Local Security Checks	2024/3/21	2024/3/21	medium
204580	Photon OS 5.0: Curl PHSA-2024-5.0-0280	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	medium
215718	Azure Linux 3.0 Security Update: cmake / curl / mysql (CVE-2023-46218)	Nessus	Azure Linux Local Security Checks	2025/2/10	2025/9/15	medium
186639	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : curl (SUSE-SU-2023:4659-1)	Nessus	SuSE Local Security Checks	2023/12/7	2024/2/2	medium
187844	Amazon Linux 2 : curl (ALAS-2024-2385)	Nessus	Amazon Linux Local Security Checks	2024/1/9	2024/12/11	critical
192956	Rocky Linux 8 : curl (RLSA-2024:1601)	Nessus	Rocky Linux Local Security Checks	2024/4/5	2024/4/8	medium
276435	TencentOS Server 4: curl (TSSA-2024:0355)	Nessus	Tencent Local Security Checks	2025/11/20	2025/11/20	medium
192331	EulerOS Virtualization 2.11.1 : curl (EulerOS-SA-2024-1411)	Nessus	Huawei Local Security Checks	2024/3/21	2025/11/5	critical
201946	Tenable.ad < 3.59.5 Multiple Vulnerabilities (TNS-2024-11)	Nessus	Misc.	2024/7/8	2025/2/13	high
206821	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20230302.100187)	Nessus	Misc.	2024/9/9	2025/10/6	critical
503949	Siemens SIMATIC S7-1500 Improper Input Validation (CVE-2023-46218)	Tenable OT Security	Tenable.ot	2025/11/13	2025/11/13	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

critical

medium

medium

critical

high

critical

medium