因此，它受到 ALAS2022-2022-145 公告中提及的多个漏洞影响。

  - 恶意服务器可在 HTTP 响应中提供过量的 `Set-Cookie:`  标头，而低于 7.84.0 版的 curl 会存储所有这些标头。数量够多（大）的 cookie 会向此服务器或这些 cookie 相匹配的其他服务器发出后续 HTTP 请求，从而使创建的请求超过 curl 为避免发送过大请求（1048576 字节）而在内部使用的阈值，而没有返回错误。只要保留和匹配这些 cookie 并且它们未过期，此拒绝状态就可能持续存在。由于 cookie 匹配规则，“foo.example.com”上的服务器可以设置匹配“bar.example.com”的 cookie，从而使同级服务器可以有效造成相同二级域上使用此方法的同级网站拒绝服务。(CVE-2022-32205)

  - curl 7.84.0 以下版本支持链接的 HTTP 压缩算法，这意味着服务器响应可被多次压缩，并且可能使用不同的算法。此解压缩链中可接受的链接数量不受限制，因此恶意服务器可以插入数量几乎无限制的压缩步骤。使用此类解压缩链可能导致 malloc 炸弹，使 curl 最终消耗大量分配的堆内存，或尝试并返回内存不足错误。(CVE-2022-32206)

  - 低于 7.84.0 版的 curl 将 cookie、alt-svc 和 hsts 数据保存到本地文件时，会通过将临时名称重命名为最终目标文件名称来完成操作，从而使该操作成为原子型操作。在该重命名操作中，它可能会意外*放宽*对目标文件的权限，使更多用户可访问更新后的文件。(CVE-2022-32207)

  - 低于 7.84.0 版的 curl 在执行受 krb5 保护的 FTP 传输时，会错误处理消息验证失败。
    攻击者可利用此缺陷执行中间人攻击而不被发现，甚至可以向客户端注入数据。(CVE-2022-32208)

  - 当 curl 用于检索和解析来自 HTTP(S) 服务器的 cookie 时，它使用控制代码接受 cookie，这些代码稍后被发送回 HTTP 服务器时可能会使服务器返回 400 响应。
    有效地令辅助站点拒绝向所有同级站点提供服务。(CVE-2022-35252)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程 Ubuntu 16.04 ESM 主机上安装的多个程序包受到 USN-5499-1 公告中提及的多个漏洞影响。

  - 低于 7.84.0 版的 curl 在执行受 krb5 保护的 FTP 传输时，会错误处理消息验证失败。
    攻击者可利用此缺陷执行中间人攻击而不被发现，甚至可以向客户端注入数据。(CVE-2022-32208)

  - libcurl 提供“CURLOPT_CERTINFO”选项，以允许应用程序请求返回有关服务器证书链的详细信息。由于使用错误函数，恶意服务器可造成使用 NSS 构建的 libcurl 在尝试检索此信息时被卡在忙碌等待的死循环中。
    (CVE-2022-27781)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程主机上安装的 Splunk 版本低于测试版本。因此，该应用程序受到 SVD-2023-0613 公告中提及的一个漏洞影响。

  - 在 Node.js 0.8.3 之前的 xmldom（以 @xmldom/xmldom 发布）程序包中 dom.js 中，函数副本通过 p 变量存在原型污染漏洞。注意：供应商表示我们正在将此报告标记为无效；但是，一些第三方认为，原型注入/原型污染不仅会在全局对象受到递归合并或深度克隆的污染时发生，而且还会在目标对象受到污染时发生。(CVE-2022-37616)

  - 低于 7.84.0 版的 curl 将 cookie、alt-svc 和 hsts 数据保存到本地文件时，会通过将临时名称重命名为最终目标文件名称来完成操作，从而使该操作成为原子型操作。在该重命名操作中，它可能会意外*放宽*对目标文件的权限，使更多用户可访问更新后的文件。(CVE-2022-32207)

  - 在低于 2.10.3 版的 libxml2 中发现一个问题。在启用 XML_PARSE_HUGE 解析器选项的情况下解析多 GB 的 XML 文档时，多个整数计数器可能溢出。这会导致尝试以负 2GB 偏移量访问数组，通常会引起分段错误。(CVE-2022-40303)

  - 在低于 2.10.3 版的 libxml2 中发现一个问题。某些无效的 XML 实体定义可损坏哈希表密钥，从而可能导致后续出现逻辑错误。在一种情况下，可能会引发双重释放。(CVE-2022-40304)

  - 存在一个与 X.509 GeneralName 内的 X.400 地址处理相关的类型混淆漏洞。
    X.400 地址被解析为 ASN1_STRING，但 GENERAL_NAME 的公共结构定义错误地将 x400Address 字段的类型指定为 ASN1_TYPE。随后，按照 OpenSSL 函数 GENERAL_NAME_cmp 的解读，此字段应为 ASN1_TYPE 而不是 ASN1_STRING。CRL 检查启用（即应用程序设置 X509_V_FLAG_CRL_CHECK 标记）后，攻击者利用此漏洞可向 memcmp 调用传递任意指针，让指针能够读取内存内容或引起拒绝服务。在大多数情况下，攻击者需要同时提供证书链和 CRL 才能发起攻击，而这两者都不需要具有有效的签名。如果攻击者仅控制其中一个输入，则另一个输入必须已包含作为 CRL 分发点的 X.400 地址，但这种情况并不常见。因此，此漏洞最有可能只影响本身已实现通过网络检索 CRL 功能的应用程序。(CVE-2023-0286)

请注意，Nessus 尚未测试此问题，而是只依据应用程序自我报告的版本号进行判断。

The remote host is affected by the vulnerability described in GLSA-202212-01 (curl: Multiple Vulnerabilities)

  - When curl is instructed to download content using the metalink feature, thecontents is verified against a     hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same     contentfrom a set of different URLs, potentially hosted by different servers and theclient can then     download the file from one or several of them. In a serial orparallel manner.If one of the servers hosting     the contents has been breached and the contentsof the specific file on that server is replaced with a     modified payload, curlshould detect this when the hash of the file mismatches after a completeddownload.
    It should remove the contents and instead try getting the contentsfrom another URL. This is not done, and     instead such a hash mismatch is onlymentioned in text and the potentially malicious content is kept in the     file ondisk. (CVE-2021-22922)

  - When curl is instructed to get content using the metalink feature, and a user name and password are used     to download the metalink XML file, those same credentials are then subsequently passed on to each of the     servers from which curl will download or try to download the contents from. Often contrary to the user's     expectations and intentions and without telling the user it happened. (CVE-2021-22923)

  - curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used     option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for     sending `NEW_ENV` variables, libcurlcould be made to pass on uninitialized data from a stack based buffer     to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-     text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing     the string provided by the application. (CVE-2021-22925)

  - libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is     done with the `CURLOPT_SSLCERT` option (`--cert` with the command line tool).When libcurl is built to use     the macOS native TLS library Secure Transport, an application can ask for the client certificate by name     or with a file name - using the same option. If the name exists as a file, it will be used instead of by     name.If the appliction runs with a current working directory that is writable by other users (like     `/tmp`), a malicious user can create a file name with the same name as the app wants to use by name, and     thereby trick the application to use the file based cert instead of the one referred to by name making     libcurl send the wrong client certificate in the TLS connection handshake. (CVE-2021-22926)

  - When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously     keep a pointer to an already freed memory area and both use that again in a subsequent call to send data     and also free it *again*. (CVE-2021-22945)

  - A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an     IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL`     or `CURLUSESSL_ALL` withlibcurl). This requirement could be bypassed if the server would return a properly     crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations
    **withoutTLS** contrary to the instructions and expectations, exposing possibly sensitive data in clear     text over the network. (CVE-2021-22946)

  - When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to     upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches.
    curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using     and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw,     it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS     traffic from the legitimate server and trick curl into sending data back to the user thinking the     attacker's injected data comes from the TLS-protected server. (CVE-2021-22947)

  - An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow     reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated     with the same credentials as set for this transfer. This affects SASL-enabled protocols: SMPTP(S),     IMAP(S), POP3(S) and LDAP(S) (openldap only). (CVE-2022-22576)

  - An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are     affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with     authentication could leak credentials to other services that exist on different protocols or port numbers.
    (CVE-2022-27774)

  - An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an     IPv6 address that was in the connection pool but with a different zone id it could reuse a connection     instead. (CVE-2022-27775)

  - A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or     cookie header data on HTTP redirects to the same host but another port number. (CVE-2022-27776)

  - libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a     trailing dot.curl can be told to receive and send cookies. curl's cookie engine can bebuilt with or     without [Public Suffix List](https://publicsuffix.org/)awareness. If PSL support not provided, a more     rudimentary check exists to atleast prevent cookies from being set on TLDs. This check was broken if     thehost name in the URL uses a trailing dot.This can allow arbitrary sites to set cookies that then would     get sent to adifferent and unrelated site or domain. (CVE-2022-27779)

  - The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name     part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For     example, a URL like `http://example.com%2F127.0.0.1/`, would be allowed bythe parser and get transposed     into `http://example.com/127.0.0.1/`. This flawcan be used to circumvent filters, checks and more.
    (CVE-2022-27780)

  - libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned     about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl     built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation.
    (CVE-2022-27781)

  - libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed     that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for     subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were     left out from the configuration match checks, making themmatch too easily. (CVE-2022-27782)

  - Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-     text HTTP step even when HTTP is provided in theURL. This mechanism could be bypassed if the host name in     the given URL used atrailing dot while not using one when it built the HSTS cache. Or the otherway around
    - by having the trailing dot in the HSTS cache and *not* using thetrailing dot in the URL.
    (CVE-2022-30115)

  - A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and     curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP     requests to this, or other servers to which the cookies match, create requests that become larger than the     threshold that curl uses internally to avoid sending crazy large requests (1048576 bytes) and instead     returns an error.This denial state might remain for as long as the same cookies are kept, match and     haven't expired. Due to cookie matching rules, a server on `foo.example.com` can set cookies that also     would match for `bar.example.com`, making it it possible for a sister server to effectively cause a     denial of service for a sibling site on the same second level domain using this method. (CVE-2022-32205)

  - curl < 7.84.0 supports chained HTTP compression algorithms, meaning that a serverresponse can be     compressed multiple times and potentially with different algorithms. The number of acceptable links in     this decompression chain was unbounded, allowing a malicious server to insert a virtually unlimited     number of compression steps.The use of such a decompression chain could result in a malloc bomb,     makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of     memory errors. (CVE-2022-32206)

  - When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by     finalizing the operation with a rename from a temporary name to the final target file name.In that rename     operation, it might accidentally *widen* the permissions for the target file, leaving the updated file     accessible to more users than intended. (CVE-2022-32207)

  - When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly.
    This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject     data to the client. (CVE-2022-32208)

  - When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to     ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle     previously was used to issue a `PUT` request which used that callback. This flaw may surprise the     application and cause it to misbehave and either send off the wrong data or use memory after free or     similar in the subsequent `POST` request. The problem exists in the logic for a reused handle when it is     changed from a PUT to a POST. (CVE-2022-32221)

  - When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control     codes that when later are sent back to a HTTPserver might make the server return 400 responses.
    Effectively allowing asister site to deny service to all siblings. (CVE-2022-35252)

  - curl can be told to parse a `.netrc` file for credentials. If that file endsin a line with 4095     consecutive non-white space letters and no newline, curlwould first read past the end of the stack-based     buffer, and if the readworks, write a zero byte beyond its boundary.This will in most cases cause a     segfault or similar, but circumstances might also cause different outcomes.If a malicious user can provide     a custom netrc file to an application or otherwise affect its contents, this flaw could be used as denial-     of-service. (CVE-2022-35260)

  - curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-     HTTP(S) URL, it sets up the connection to the remote server by issuing a CONNECT request to the proxy, and     then tunnels the rest of the protocol through. An HTTP proxy might refuse this request (HTTP proxies often     only allow outgoing connections to specific port numbers, like 443 for HTTPS) and instead return a non-200     status code to the client. Due to flaws in the error/cleanup handling, this could trigger a double free in     curl if one of the following schemes were used in the URL for the transfer: dict, gopher, gophers, ldap,     ldaps, rtmp, rtmps, or telnet. The earliest affected version is 7.77.0. (CVE-2022-42915)

  - In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS     support, curl can be instructed to use HTTPS directly (instead of using an insecure cleartext HTTP step)     even when HTTP is provided in the URL. This mechanism could be bypassed if the host name in the given URL     uses IDN characters that get replaced with ASCII counterparts as part of the IDN conversion, e.g., using     the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop of U+002E (.).
    The earliest affected version is 7.77.0 2021-05-26. (CVE-2022-42916)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned     about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl     built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation.
    (CVE-2022-27781)

  - libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed     that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for     subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were     left out from the configuration match checks, making themmatch too easily. (CVE-2022-27782)

  - A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and     curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP     requests to this, or other servers to which the cookies match, create requests that become larger than the     threshold that curl uses internally to avoid sending crazy large requests (1048576 bytes) and instead     returns an error.This denial state might remain for as long as the same cookies are kept, match and     haven't expired. Due to cookie matching rules, a server on `foo.example.com` can set cookies that also     would match for `bar.example.com`, making it it possible for a 'sister server' to effectively cause a     denial of service for a sibling site on the same second level domain using this method. (CVE-2022-32205)

  - curl < 7.84.0 supports 'chained' HTTP compression algorithms, meaning that a serverresponse can be     compressed multiple times and potentially with different algorithms. The number of acceptable 'links' in     this 'decompression chain' was unbounded, allowing a malicious server to insert a virtually unlimited     number of compression steps.The use of such a decompression chain could result in a 'malloc bomb',     makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of     memory errors. (CVE-2022-32206)

  - When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by     finalizing the operation with a rename from a temporary name to the final target file name.In that rename     operation, it might accidentally *widen* the permissions for the target file, leaving the updated file     accessible to more users than intended. (CVE-2022-32207)

  - When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly.
    This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject     data to the client. (CVE-2022-32208)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:6157 advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2305-1 advisory.

  - A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and     curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP     requests to this, or other servers to which the cookies match, create requests that become larger than the     threshold that curl uses internally to avoid sending crazy large requests (1048576 bytes) and instead     returns an error.This denial state might remain for as long as the same cookies are kept, match and     haven't expired. Due to cookie matching rules, a server on `foo.example.com` can set cookies that also     would match for `bar.example.com`, making it it possible for a sister server to effectively cause a     denial of service for a sibling site on the same second level domain using this method. (CVE-2022-32205)

  - curl < 7.84.0 supports chained HTTP compression algorithms, meaning that a serverresponse can be     compressed multiple times and potentially with different algorithms. The number of acceptable links in     this decompression chain was unbounded, allowing a malicious server to insert a virtually unlimited     number of compression steps.The use of such a decompression chain could result in a malloc bomb,     makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of     memory errors. (CVE-2022-32206)

  - When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by     finalizing the operation with a rename from a temporary name to the final target file name.In that rename     operation, it might accidentally *widen* the permissions for the target file, leaving the updated file     accessible to more users than intended. (CVE-2022-32207)

  - When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly.
    This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject     data to the client. (CVE-2022-32208)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2327-1 advisory.

  - curl < 7.84.0 supports chained HTTP compression algorithms, meaning that a serverresponse can be     compressed multiple times and potentially with different algorithms. The number of acceptable links in     this decompression chain was unbounded, allowing a malicious server to insert a virtually unlimited     number of compression steps.The use of such a decompression chain could result in a malloc bomb,     makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of     memory errors. (CVE-2022-32206)

  - When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly.
    This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject     data to the client. (CVE-2022-32208)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:6159 advisory.

  - curl < 7.84.0 supports chained HTTP compression algorithms, meaning that a serverresponse can be     compressed multiple times and potentially with different algorithms. The number of acceptable links in     this decompression chain was unbounded, allowing a malicious server to insert a virtually unlimited     number of compression steps.The use of such a decompression chain could result in a malloc bomb,     makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of     memory errors. (CVE-2022-32206)

  - When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly.
    This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject     data to the client. (CVE-2022-32208)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-145 advisory.

  - A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and     curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP     requests to this, or other servers to which the cookies match, create requests that become larger than the     threshold that curl uses internally to avoid sending crazy large requests (1048576 bytes) and instead     returns an error.This denial state might remain for as long as the same cookies are kept, match and     haven't expired. Due to cookie matching rules, a server on `foo.example.com` can set cookies that also     would match for `bar.example.com`, making it it possible for a sister server to effectively cause a     denial of service for a sibling site on the same second level domain using this method. (CVE-2022-32205)

  - curl < 7.84.0 supports chained HTTP compression algorithms, meaning that a serverresponse can be     compressed multiple times and potentially with different algorithms. The number of acceptable links in     this decompression chain was unbounded, allowing a malicious server to insert a virtually unlimited     number of compression steps.The use of such a decompression chain could result in a malloc bomb,     makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of     memory errors. (CVE-2022-32206)

  - When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by     finalizing the operation with a rename from a temporary name to the final target file name.In that rename     operation, it might accidentally *widen* the permissions for the target file, leaving the updated file     accessible to more users than intended. (CVE-2022-32207)

  - When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly.
    This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject     data to the client. (CVE-2022-32208)

  - When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control     codes that when later are sent back to a HTTPserver might make the server return 400 responses.
    Effectively allowing asister site to deny service to all siblings. (CVE-2022-35252)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and     curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP     requests to this, or other servers to which the cookies match, create requests that become larger than the     threshold that curl uses internally to avoid sending crazy large requests (1048576 bytes) and instead     returns an error.This denial state might remain for as long as the same cookies are kept, match and     haven't expired. Due to cookie matching rules, a server on `foo.example.com` can set cookies that also     would match for `bar.example.com`, making it it possible for a 'sister server' to effectively cause a     denial of service for a sibling site on the same second level domain using this method. (CVE-2022-32205)

  - curl < 7.84.0 supports 'chained' HTTP compression algorithms, meaning that a serverresponse can be     compressed multiple times and potentially with different algorithms. The number of acceptable 'links' in     this 'decompression chain' was unbounded, allowing a malicious server to insert a virtually unlimited     number of compression steps.The use of such a decompression chain could result in a 'malloc bomb',     makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of     memory errors. (CVE-2022-32206)

  - When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by     finalizing the operation with a rename from a temporary name to the final target file name.In that rename     operation, it might accidentally *widen* the permissions for the target file, leaving the updated file     accessible to more users than intended. (CVE-2022-32207)

  - When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly.
    This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject     data to the client. (CVE-2022-32208)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the curl package has been released.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5499-1 advisory.

    Florian Kohnhuser discovered that curl incorrectly handled returning a TLS servers certificate chain     details. A remote attacker could possibly use this issue to cause curl to stop responding, resulting in a     denial of service. (CVE-2022-27781)

    Harry Sintonen discovered that curl incorrectly handled certain FTP-KRB messages. An attacker could     possibly use this to perform a machine-in-the-middle attack. (CVE-2022-32208)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2023-0613 advisory.

  - A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as     @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states we are in     the process of marking this report as invalid; however, some third parties takes the position that A     prototype injection/Prototype pollution is not just when global objects are polluted with recursive merge     or deep cloning but also when a target object is polluted. (CVE-2022-37616)

  - When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by     finalizing the operation with a rename from a temporary name to the final target file name.In that rename     operation, it might accidentally *widen* the permissions for the target file, leaving the updated file     accessible to more users than intended. (CVE-2022-32207)

  - An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the     XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to     access an array at a negative 2GB offset, typically leading to a segmentation fault. (CVE-2022-40303)

  - An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a     hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be     provoked. (CVE-2022-40304)

  - There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName.
    X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME     incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently     interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL     checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may     allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or     enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate     chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these     inputs, the other input must already contain an X.400 address as a CRL distribution point, which is     uncommon. As such, this vulnerability is most likely to only affect applications which have implemented     their own functionality for retrieving CRLs over a network. (CVE-2023-0286)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

ID	名稱	產品	系列	已發布	已更新	嚴重性
166129	Amazon Linux 2022：(ALAS2022-2022-145)	Nessus	Amazon Linux Local Security Checks	2022/10/14	2023/10/9	critical
162691	Ubuntu 16.04 ESM：curl 漏洞 (USN-5499-1)	Nessus	Ubuntu Local Security Checks	2022/7/1	2024/8/28	medium
194919	Splunk Enterprise <8.1.14、8.2.0 < 8.2.11、9.0.0 < 9.0.5 (SVD-2023-0613)	Nessus	CGI abuses	2024/5/2	2024/7/26	critical
194926	Universal Forwarders 8.2.0 < 8.2.12、9.0.0 < 9.0.6、9.1.0 < 9.1.1 (SVD-2023-0809)	Nessus	CGI abuses	2024/5/2	2024/5/30	critical
168911	GLSA-202212-01 : curl: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2022/12/18	2023/9/12	critical
169329	EulerOS Virtualization 2.10.0 : curl (EulerOS-SA-2022-2872)	Nessus	Huawei Local Security Checks	2022/12/27	2023/9/12	critical
169338	EulerOS Virtualization 2.10.1 : curl (EulerOS-SA-2022-2890)	Nessus	Huawei Local Security Checks	2022/12/27	2023/9/12	critical
167705	AlmaLinux 9 : curl (ALSA-2022:6157)	Nessus	Alma Linux Local Security Checks	2022/11/16	2023/10/3	critical
162927	SUSE SLED15 / SLES15 Security Update : curl (SUSE-SU-2022:2305-1)	Nessus	SuSE Local Security Checks	2022/7/8	2023/7/14	critical
162956	SUSE SLED15 / SLES15 Security Update : curl (SUSE-SU-2022:2327-1)	Nessus	SuSE Local Security Checks	2022/7/8	2023/7/14	medium
164490	Rocky Linux 8 : curl (RLSA-2022:6159)	Nessus	Rocky Linux Local Security Checks	2022/8/29	2023/11/7	medium
166129	Amazon Linux 2022 : (ALAS2022-2022-145)	Nessus	Amazon Linux Local Security Checks	2022/10/14	2023/10/9	critical
165779	EulerOS 2.0 SP10 : curl (EulerOS-SA-2022-2426)	Nessus	Huawei Local Security Checks	2022/10/8	2023/10/10	critical
203303	Photon OS 4.0: Curl PHSA-2022-4.0-0207	Nessus	PhotonOS Local Security Checks	2024/7/23	2024/7/23	critical
162691	Ubuntu 16.04 ESM : curl vulnerabilities (USN-5499-1)	Nessus	Ubuntu Local Security Checks	2022/7/1	2024/8/28	medium
194919	Splunk Enterprise < 8.1.14, 8.2.0 < 8.2.11, 9.0.0 < 9.0.5 (SVD-2023-0613)	Nessus	CGI abuses	2024/5/2	2024/7/26	critical
194926	Universal Forwarder 8.2.0 < 8.2.12, 9.0.0 < 9.0.6, 9.1.0 < 9.1.1 (SVD-2023-0809)	Nessus	CGI abuses	2024/5/2	2024/5/30	critical
501083	Siemens SCALANCE XCM332 Out-of-Bounds Write (CVE-2022-32208)	Tenable OT Security	Tenable.ot	2023/5/2	2024/9/4	medium

偵測

搜尋 Plugin

critical

medium

critical

critical

critical

critical

critical

critical

critical

medium

medium

critical

critical

critical

medium

critical

critical

medium