The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5964-1 advisory.

    Harry Sintonen discovered that curl incorrectly handled certain TELNET connection options. Due to lack of     proper input scrubbing, curl could pass on user name and telnet options to the server as provided,     contrary to expectations. (CVE-2023-27533)

    Harry Sintonen discovered that curl incorrectly handled special tilde characters when used with SFTP     paths. A remote attacker could possibly use this issue to circumvent filtering. (CVE-2023-27534)

    Harry Sintonen discovered that curl incorrectly reused certain FTP connections. This could lead to the     wrong credentials being reused, contrary to expectations. (CVE-2023-27535)

    Harry Sintonen discovered that curl incorrectly reused connections when the GSS delegation option had been     changed. This could lead to the option being reused, contrary to expectations. (CVE-2023-27536)

    Harry Sintonen discovered that curl incorrectly reused certain SSH connections. This could lead to the     wrong credentials being reused, contrary to expectations. (CVE-2023-27538)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of curl installed on the remote host is prior to 8.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2023-079-01 advisory.

  - A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may     allow an attacker to pass on maliciously crafted user name and telnet options during server negotiation.
    The lack of proper input scrubbing allows an attacker to send content or perform option negotiation     without the application's intent. This vulnerability could be exploited if an application allows user     input, thereby enabling attackers to execute arbitrary code on the system. (CVE-2023-27533)

  - A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to     be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as     the first element to indicate a path relative to the user's home directory. Attackers can exploit this     flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a     server with a specific user. (CVE-2023-27534)

  - An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that     can result in wrong credentials being used during subsequent transfers. Previously created connections are     kept in a connection pool for reuse if they match the current setup. However, certain FTP settings such as     CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC, and CURLOPT_USE_SSL were not     included in the configuration match checks, causing them to match too easily. This could lead to libcurl     using the wrong credentials when performing a transfer, potentially allowing unauthorized access to     sensitive information. (CVE-2023-27535)

  - An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can     reuse previously established connections with incorrect user permissions due to a failure to check for     changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI     transfers and could potentially result in unauthorized access to sensitive information. The safest option     is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed. (CVE-2023-27536)

  - A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate handles.
    This sharing was introduced without considerations for do this sharing across separate threads but there     was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads     sharing the same HSTS data could end up doing a double-free or use-after-free. (CVE-2023-27537)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may     allow an attacker to pass on maliciously crafted user name and 'telnet options' during server negotiation.
    The lack of proper input scrubbing allows an attacker to send content or perform option negotiation     without the application's intent. This vulnerability could be exploited if an application allows user     input, thereby enabling attackers to execute arbitrary code on the system. (CVE-2023-27533)

  - A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to     be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as     the first element to indicate a path relative to the user's home directory. Attackers can exploit this     flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a     server with a specific user. (CVE-2023-27534)

  - An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that     can result in wrong credentials being used during subsequent transfers. Previously created connections are     kept in a connection pool for reuse if they match the current setup. However, certain FTP settings such as     CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC, and CURLOPT_USE_SSL were not     included in the configuration match checks, causing them to match too easily. This could lead to libcurl     using the wrong credentials when performing a transfer, potentially allowing unauthorized access to     sensitive information. (CVE-2023-27535)

  - An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can     reuse previously established connections with incorrect user permissions due to a failure to check for     changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI     transfers and could potentially result in unauthorized access to sensitive information. The safest option     is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed. (CVE-2023-27536)

  - An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously     established SSH connection despite the fact that an SSH option was modified, which should have prevented     reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent transfers if     the configurations match. However, two SSH settings were omitted from the configuration check, allowing     them to match easily, potentially leading to the reuse of an inappropriate connection. (CVE-2023-27538)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of curl installed on the remote host is prior to 8.0.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2070 advisory.

    The curl advisory describes this issue as follows:

    curl supports communicating using the TELNET protocol and as a part of this it offers users to pass on     user name and telnet options for the server negotiation.

    Due to lack of proper input scrubbing and without it being the documented functionality, curl would pass     on user name and telnet options to the server as provided. This could allow users to pass in carefully     crafted content that pass on content or do option negotiation without the application intending to do so.
    In particular if an application for example allows users to provide the data or parts of the data.
    (CVE-2023-27533)

    The curl advisory describes this issue as follows:

    curl supports SFTP transfers. curl's SFTP implementation offers a special feature in the path component of     URLs: a tilde (~) character as the first path element in the path to denotes a path relative to the user's     home directory. This is supported because of wording in the once proposed to-become RFC draft that was to     dictate how SFTP URLs work.

    Due to a bug, the handling of the tilde in SFTP path did however not only replace it when it is used     stand-alone as the first path element but also wrongly when used as a mere prefix in the first element.

    Using a path like /~2/foo when accessing a server using the user dan (with home directory /home/dan) would     then quite surprisingly access the file /home/dan2/foo.

    This can be taken advantage of to circumvent filtering or worse. (CVE-2023-27534)

    The curl advisory describes this issue as follows:

    libcurl would reuse a previously created FTP connection even when one or more options had been changed     that could have made the effective user a very different one, thus leading to the doing the second     transfer with wrong credentials. (CVE-2023-27535)

    The curl advisory describes this issue as follows:

    libcurl would reuse a previously created connection even when the GSS delegation     (CURLOPT_GSSAPI_DELEGATION) option had been changed that could have changed the user's permissions in a     second transfer.

    libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of     them matches the setup. However, this GSS delegation setting was left out from the configuration match     checks, making them match too easily, affecting krb5/kerberos/negotiate/GSSAPI transfers. (CVE-2023-27536)

    The curl advisory describes this issue as follows:

    libcurl supports sharing HSTS data between separate handles. This sharing was introduced without     considerations for doing this sharing across separate threads, but there was no indication of this fact in     the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could     end up doing a double-free or use-after-free. (CVE-2023-27537)

    The curl advisory describes this issue as follows:

    libcurl would reuse a previously created connection even when an SSH related option had been changed that     should have prohibited reuse.

    libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of     them matches the setup. However, two SSH settings were left out from the configuration match checks,     making them match too easily. (CVE-2023-27538)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may     allow an attacker to pass on maliciously crafted user name and 'telnet options' during server negotiation.
    The lack of proper input scrubbing allows an attacker to send content or perform option negotiation     without the application's intent. This vulnerability could be exploited if an application allows user     input, thereby enabling attackers to execute arbitrary code on the system. (CVE-2023-27533)

  - A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to     be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as     the first element to indicate a path relative to the user's home directory. Attackers can exploit this     flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a     server with a specific user. (CVE-2023-27534)

  - An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that     can result in wrong credentials being used during subsequent transfers. Previously created connections are     kept in a connection pool for reuse if they match the current setup. However, certain FTP settings such as     CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC, and CURLOPT_USE_SSL were not     included in the configuration match checks, causing them to match too easily. This could lead to libcurl     using the wrong credentials when performing a transfer, potentially allowing unauthorized access to     sensitive information. (CVE-2023-27535)

  - An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can     reuse previously established connections with incorrect user permissions due to a failure to check for     changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI     transfers and could potentially result in unauthorized access to sensitive information. The safest option     is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed. (CVE-2023-27536)

  - An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously     established SSH connection despite the fact that an SSH option was modified, which should have prevented     reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent transfers if     the configurations match. However, two SSH settings were omitted from the configuration check, allowing     them to match easily, potentially leading to the reuse of an inappropriate connection. (CVE-2023-27538)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may     allow an attacker to pass on maliciously crafted user name and 'telnet options' during server negotiation.
    The lack of proper input scrubbing allows an attacker to send content or perform option negotiation     without the application's intent. This vulnerability could be exploited if an application allows user     input, thereby enabling attackers to execute arbitrary code on the system. (CVE-2023-27533)

  - A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to     be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as     the first element to indicate a path relative to the user's home directory. Attackers can exploit this     flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a     server with a specific user. (CVE-2023-27534)

  - An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that     can result in wrong credentials being used during subsequent transfers. Previously created connections are     kept in a connection pool for reuse if they match the current setup. However, certain FTP settings such as     CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC, and CURLOPT_USE_SSL were not     included in the configuration match checks, causing them to match too easily. This could lead to libcurl     using the wrong credentials when performing a transfer, potentially allowing unauthorized access to     sensitive information. (CVE-2023-27535)

  - An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can     reuse previously established connections with incorrect user permissions due to a failure to check for     changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI     transfers and could potentially result in unauthorized access to sensitive information. The safest option     is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed. (CVE-2023-27536)

  - An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously     established SSH connection despite the fact that an SSH option was modified, which should have prevented     reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent transfers if     the configurations match. However, two SSH settings were omitted from the configuration check, allowing     them to match easily, potentially leading to the reuse of an inappropriate connection. (CVE-2023-27538)

  - An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of     wildcard patterns when listed as 'Subject Alternative Name' in TLS server certificates. curl can be built     to use its own name matching function for TLS rather than one provided by a TLS library. This private     wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a     result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before     used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to     pattern match, but the wildcard check in curl could still check for `x*`, which would match even though     the IDN name most likely contained nothing even resembling an `x`. (CVE-2023-28321)

  - An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might     erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the     `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request     which used that callback. This flaw may surprise the application and cause it to misbehave and either send     off the wrong data or use memory after free or similar in the second transfer. The problem exists in the     logic for a reused handle when it is (expected to be) changed from a PUT to a POST. (CVE-2023-28322)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may     allow an attacker to pass on maliciously crafted user name and 'telnet options' during server negotiation.
    The lack of proper input scrubbing allows an attacker to send content or perform option negotiation     without the application's intent. This vulnerability could be exploited if an application allows user     input, thereby enabling attackers to execute arbitrary code on the system. (CVE-2023-27533)

  - A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to     be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as     the first element to indicate a path relative to the user's home directory. Attackers can exploit this     flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a     server with a specific user. (CVE-2023-27534)

  - An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that     can result in wrong credentials being used during subsequent transfers. Previously created connections are     kept in a connection pool for reuse if they match the current setup. However, certain FTP settings such as     CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC, and CURLOPT_USE_SSL were not     included in the configuration match checks, causing them to match too easily. This could lead to libcurl     using the wrong credentials when performing a transfer, potentially allowing unauthorized access to     sensitive information. (CVE-2023-27535)

  - An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can     reuse previously established connections with incorrect user permissions due to a failure to check for     changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI     transfers and could potentially result in unauthorized access to sensitive information. The safest option     is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed. (CVE-2023-27536)

  - An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously     established SSH connection despite the fact that an SSH option was modified, which should have prevented     reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent transfers if     the configurations match. However, two SSH settings were omitted from the configuration check, allowing     them to match easily, potentially leading to the reuse of an inappropriate connection. (CVE-2023-27538)

  - An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of     wildcard patterns when listed as 'Subject Alternative Name' in TLS server certificates. curl can be built     to use its own name matching function for TLS rather than one provided by a TLS library. This private     wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a     result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before     used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to     pattern match, but the wildcard check in curl could still check for `x*`, which would match even though     the IDN name most likely contained nothing even resembling an `x`. (CVE-2023-28321)

  - An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might     erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the     `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request     which used that callback. This flaw may surprise the application and cause it to misbehave and either send     off the wrong data or use memory after free or similar in the second transfer. The problem exists in the     logic for a reused handle when it is (expected to be) changed from a PUT to a POST. (CVE-2023-28322)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

远程 Redhat Enterprise Linux 9 主机上安装的程序包受到 RHSA-2023: 6679 公告中提及的多个漏洞的影响。

  - 使用 TELNET 协议进行通信期间，低于 8.0 版的 curl 的输入验证存在漏洞，可能允许攻击者在服务器协商期间传递恶意构建的用户名和 telnet 选项。
    缺少正确的输入以清理允许攻击者在没有应用程序意图的情况下发送内容或执行选项协商。如果应用程序允许用户输入，则攻击者可利用此漏洞，进而能够在系统上执行任意代码。(CVE-2023-27533)

  - 在低于 8.0.0 版的 curl 的 SFTP 实现中存在一个路径遍历漏洞，除波浪号 (~) 字符预期用作第一个元素以指示相对于用户主目录的路径外，该漏洞会导致波浪号 (~) 字符在第一个路径元素中用作前缀时被错误替换。攻击者可在使用特定用户访问服务器时，通过构建类似 /~2/foo 的路径，利用此缺陷绕过过滤或执行任意代码。(CVE-2023-27534)

  - 在低于 8.0.0 版的 libcurl 的连接重用功能中存在认证绕过漏洞，由于未能检查 CURLOPT_GSSAPI_DELEGATION 选项中的更改，该漏洞可重用之前建立的连接。此漏洞会影响 krb5/kerberos/negotiate/GSSAPI 传输，并可能导致对敏感信息进行未经授权的访问。最安全的做法是在 CURLOPT_GSSAPI_DELEGATION 选项已更改时不重复使用连接。(CVE-2023-27536)

  - 在低于 v8.0.0 版的 libcurl 中存在身份验证绕过漏洞，尽管修改了 SSH 选项，但该漏洞仍会重用之前建立的 SSH 连接，而不是阻止重用。libcurl 维护一个之前使用过的连接池，以在配置匹配时将其重新用于后续传输。但是，配置检查中忽略了两个 SSH 设置，从而使这两个设置可以轻松匹配，进而可能导致重复使用不适当的连接。(CVE-2023-27538)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程 CentOS Linux 9 主机上安装的多个程序包受到 curl-7.76.1-26.el9 版本变更日志中提及的多个漏洞影响。

  - 使用 TELNET 协议进行通信期间，低于 8.0 版的 curl 的输入验证存在漏洞，可能允许攻击者在服务器协商期间传递恶意构建的用户名和 telnet 选项。
    缺少正确的输入以清理允许攻击者在没有应用程序意图的情况下发送内容或执行选项协商。如果应用程序允许用户输入，则攻击者可利用此漏洞，进而能够在系统上执行任意代码。(CVE-2023-27533)

  - 在低于 8.0.0 版的 curl 的 SFTP 实现中存在一个路径遍历漏洞，除波浪号 (~) 字符预期用作第一个元素以指示相对于用户主目录的路径外，该漏洞会导致波浪号 (~) 字符在第一个路径元素中用作前缀时被错误替换。攻击者可在使用特定用户访问服务器时，通过构建类似 /~2/foo 的路径，利用此缺陷绕过过滤或执行任意代码。(CVE-2023-27534)

  - 在低于 8.0.0 版的 libcurl 中，FTP 连接重用功能中存在一个认证绕过漏洞，可导致在后续传输期间使用错误的凭据。之前创建的连接如果与当前设置匹配，则会保留在连接池中以供重用。但是，某些 FTP 设置（例如 CURLOPT_FTP_ACCOUNT、CURLOPT_FTP_ALTERNATIVE_TO_USER、CURLOPT_FTP_SSL_CCC 和 CURLOPT_USE_SSL）未包含在配置匹配检查中，进而导致它们过于容易匹配。这可能导致 libcurl 在执行传输时使用错误的凭据，从而可能允许对敏感信息进行未经授权的访问。(CVE-2023-27535)

  - 在低于 8.0.0 版的 libcurl 的连接重用功能中存在认证绕过漏洞，由于未能检查 CURLOPT_GSSAPI_DELEGATION 选项中的更改，该漏洞可重用之前建立的连接。此漏洞会影响 krb5/kerberos/negotiate/GSSAPI 传输，并可能导致对敏感信息进行未经授权的访问。最安全的做法是在 CURLOPT_GSSAPI_DELEGATION 选项已更改时不重复使用连接。(CVE-2023-27536)

  - 在低于 v8.0.0 版的 libcurl 中存在身份验证绕过漏洞，尽管修改了 SSH 选项，但该漏洞仍会重用之前建立的 SSH 连接，而不是阻止重用。libcurl 维护一个之前使用过的连接池，以在配置匹配时将其重新用于后续传输。但是，配置检查中忽略了两个 SSH 设置，从而使这两个设置可以轻松匹配，进而可能导致重复使用不适当的连接。(CVE-2023-27538)

  - curl v8.1.0 之前版本中存在证书验证不当漏洞。它会支持比对 TLS 服务器证书中作为主题备用名称列出的通配符模式。curl 可以被建构为针对 TLS 使用其自己的名称匹配函数，而不是 TLS 库的函数。此私密通配符匹配函数会错误匹配 IDN（国际域名）主机，并因此接受本应不匹配的模式。IDN 主机名在用于证书检查之前会被转换为域名代码。Puny 编码名称总是以“xn--”开头，且不应允许进行模式匹配，但 curl 中的通配符检查仍可检查“x*”，即使 IDN 名称很可能不包含任何类似“x”的符号亦然。(CVE-2023-28321)

  - curl v8.1.0 之前版本中存在信息泄露漏洞。在进行 HTTP(S) 传输时，如果之前使用相同的句柄发出 `PUT` 请求（使用读取回调 (`CURLOPT_READFUNCTION`)），即使设置了 `CURLOPT_POSTFIELDS` 选项，libcurl 仍可能会错误地使用该回调来请求发送数据。此缺陷可能会使应用程序发生意外并导致其行为不当，在第二次传输中发送错误的数据，或使用释放后的内存或类似内容。从 PUT 更改为 POST 时（此为预期行为），重用句柄的逻辑中存在此问题。(CVE-2023-28322)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程主机上安装的 Splunk 版本低于测试版本。因此，该应用程序受到 SVD-2023-0613 公告中提及的一个漏洞影响。

  - 在 Node.js 0.8.3 之前的 xmldom（以 @xmldom/xmldom 发布）程序包中 dom.js 中，函数副本通过 p 变量存在原型污染漏洞。注意：供应商表示我们正在将此报告标记为无效；但是，一些第三方认为，原型注入/原型污染不仅会在全局对象受到递归合并或深度克隆的污染时发生，而且还会在目标对象受到污染时发生。(CVE-2022-37616)

  - 低于 7.84.0 版的 curl 将 cookie、alt-svc 和 hsts 数据保存到本地文件时，会通过将临时名称重命名为最终目标文件名称来完成操作，从而使该操作成为原子型操作。在该重命名操作中，它可能会意外*放宽*对目标文件的权限，使更多用户可访问更新后的文件。(CVE-2022-32207)

  - 在低于 2.10.3 版的 libxml2 中发现一个问题。在启用 XML_PARSE_HUGE 解析器选项的情况下解析多 GB 的 XML 文档时，多个整数计数器可能溢出。这会导致尝试以负 2GB 偏移量访问数组，通常会引起分段错误。(CVE-2022-40303)

  - 在低于 2.10.3 版的 libxml2 中发现一个问题。某些无效的 XML 实体定义可损坏哈希表密钥，从而可能导致后续出现逻辑错误。在一种情况下，可能会引发双重释放。(CVE-2022-40304)

  - 存在一个与 X.509 GeneralName 内的 X.400 地址处理相关的类型混淆漏洞。
    X.400 地址被解析为 ASN1_STRING，但 GENERAL_NAME 的公共结构定义错误地将 x400Address 字段的类型指定为 ASN1_TYPE。随后，按照 OpenSSL 函数 GENERAL_NAME_cmp 的解读，此字段应为 ASN1_TYPE 而不是 ASN1_STRING。CRL 检查启用（即应用程序设置 X509_V_FLAG_CRL_CHECK 标记）后，攻击者利用此漏洞可向 memcmp 调用传递任意指针，让指针能够读取内存内容或引起拒绝服务。在大多数情况下，攻击者需要同时提供证书链和 CRL 才能发起攻击，而这两者都不需要具有有效的签名。如果攻击者仅控制其中一个输入，则另一个输入必须已包含作为 CRL 分发点的 X.400 地址，但这种情况并不常见。因此，此漏洞最有可能只影响本身已实现通过网络检索 CRL 功能的应用程序。(CVE-2023-0286)

请注意，Nessus 尚未测试此问题，而是只依据应用程序自我报告的版本号进行判断。

远程主机受到 GLSA-202310-12 中所述漏洞的影响（curl：多个漏洞）

  - curl <7.87.0 HSTS 检查中存在漏洞，攻击者可绕过检查以诱骗程序继续使用 HTTP。
    如使用 HSTS 支持，即使在 URL 中提供了 HTTP，仍可指示 curl 使用 HTTPS，而不是使用不安全的明文 HTTP 步骤。但是，如果给定 URL 中的主机名首先使用在 IDN 转换过程中被替换为 ASCII 对应项的 IDN 字符，则可以绕过 HSTS 机制。就像使用 UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) 字符，而不是通用的 ASCII 句号 (U+002E)“.”。然后在后续请求中，程序不会检测 HSTS 状态并进行明文传输。这是因为它会存储经 IDN 编码的信息，但查找经 IDN 解码的信息。(CVE-2022-43551)

  - curl <7.87.0 中存在释放后使用漏洞。可要求 Curl 通过 HTTP 代理*传输*其支持的几乎所有协议。HTTP 代理可以（而且经常会）拒绝此类传输操作。
    如果传输特定协议 SMB 或 TELNET 被拒，Curl 会在其传输关闭代码路径中使用已释放的堆分配结构。(CVE-2022-43552)

  - curl <v7.88.0 中存在敏感信息明文传输漏洞，当连续请求多个 URL 时，可能导致 HSTS 功能失败。如使用 HSTS 支持，即使在 URL 中提供了 HTTP，仍可指示 curl 使用 HTTPS，而不是使用不安全的明文 HTTP 步骤。然而，令人意外的是，当在相同命令行上完成时，此 HSTS 机制会被后续传输忽略，因为状态不会正确维持下去。 (CVE-2023-23914)

  - curl <v7.88.0 中存在敏感信息明文传输漏洞，当同时请求多个 URL 时，可能导致 HSTS 功能表现不当。如使用 HSTS 支持，即使在 URL 中提供了 HTTP，仍可指示 curl 使用 HTTPS，而不是使用不安全的明文 HTTP 步骤。然而，当并行完成多个传输时，此 HSTS 机制会出人意料地失败，因为 HSTS 缓存文件被最近完成的传输覆盖。之后向之前主机名的仅 HTTP 传输将*不会*正确升级到 HSTS。
    (CVE-2023-23915)

  - 在基于链接的 HTTP 压缩算法且版本低于 v7.88.0 的 curl 中存在配置资源时无限制或节流的漏洞，这意味着服务器响应可被多次压缩，并且可能使用不同的算法。已针对此解压缩链中可接受的链接数量设置上限，但该上限基于每个标题设置，所以恶意服务器仅使用许多标头即可插入几乎无数量上限的压缩步骤。使用此类解压缩链可导致 malloc 炸弹，使 curl 最终消耗大量分配的堆内存，或尝试并返回内存不足错误。(CVE-2023-23916)

  - 使用 TELNET 协议进行通信期间，低于 8.0 版的 curl 的输入验证存在漏洞，可能允许攻击者在服务器协商期间传递恶意构建的用户名和 telnet 选项。
    缺少正确的输入以清理允许攻击者在没有应用程序意图的情况下发送内容或执行选项协商。如果应用程序允许用户输入，则攻击者可利用此漏洞，进而能够在系统上执行任意代码。(CVE-2023-27533)

  - 在低于 8.0.0 版的 curl 的 SFTP 实现中存在一个路径遍历漏洞，除波浪号 (~) 字符预期用作第一个元素以指示相对于用户主目录的路径外，该漏洞会导致波浪号 (~) 字符在第一个路径元素中用作前缀时被错误替换。攻击者可在使用特定用户访问服务器时，通过构建类似 /~2/foo 的路径，利用此缺陷绕过过滤或执行任意代码。(CVE-2023-27534)

  - 在低于 8.0.0 版的 libcurl 中，FTP 连接重用功能中存在一个认证绕过漏洞，可导致在后续传输期间使用错误的凭据。之前创建的连接如果与当前设置匹配，则会保留在连接池中以供重用。但是，某些 FTP 设置（例如 CURLOPT_FTP_ACCOUNT、CURLOPT_FTP_ALTERNATIVE_TO_USER、CURLOPT_FTP_SSL_CCC 和 CURLOPT_USE_SSL）未包含在配置匹配检查中，进而导致它们过于容易匹配。这可能导致 libcurl 在执行传输时使用错误的凭据，从而可能允许对敏感信息进行未经授权的访问。(CVE-2023-27535)

  - 在低于 8.0.0 版的 libcurl 的连接重用功能中存在认证绕过漏洞，由于未能检查 CURLOPT_GSSAPI_DELEGATION 选项中的更改，该漏洞可重用之前建立的连接。此漏洞会影响 krb5/kerberos/negotiate/GSSAPI 传输，并可能导致对敏感信息进行未经授权的访问。最安全的做法是在 CURLOPT_GSSAPI_DELEGATION 选项已更改时不重复使用连接。(CVE-2023-27536)

  - 在低于 8.0.0 版的 libcurl 中，若在单独的句柄之间共享 HSTS 数据，则会出现双重释放漏洞。
    引入此共享时未考虑在单独的线程之间执行此共享，但文档未对此情况进行说明。由于缺少互斥体或线程锁，共享相同 HSTS 数据的两个线程可能以执行双重释放或释放后使用而告终。(CVE-2023-27537)

  - 在低于 v8.0.0 版的 libcurl 中存在身份验证绕过漏洞，尽管修改了 SSH 选项，但该漏洞仍会重用之前建立的 SSH 连接，而不是阻止重用。libcurl 维护一个之前使用过的连接池，以在配置匹配时将其重新用于后续传输。但是，配置检查中忽略了两个 SSH 设置，从而使这两个设置可以轻松匹配，进而可能导致重复使用不适当的连接。(CVE-2023-27538)

  - 低于 v8.1.0 的 curl 中存在一个释放后使用漏洞，libcurl 借此提供了使用 SHA 256 哈希验证 SSH 服务器公钥的功能。若此检查失败，libcurl 会先释放指纹内存，然后再返回含有（现已释放）哈希的错误消息。此缺陷存在将基于堆的敏感数据插入本可能向用户显示或以其他方式泄露和显示的错误消息的风险。(CVE-2023-28319)

  - 低于 v8.1.0 的 curl 中存在一个拒绝服务漏洞，libcurl 提供了几种不同的后端来解析主机名，以供在构建时选择。如果构建为使用同步解析器，则会允许名称解析使用“alarm()”和“siglongjmp()”暂停缓慢的操作。执行此操作时，libcurl 使用了不受互斥体保护的全局缓冲区，多线程的应用程序可能因此崩溃或出现其他错误行为。(CVE-2023-28320)

  - curl v8.1.0 之前版本中存在证书验证不当漏洞。它会支持比对 TLS 服务器证书中作为主题备用名称列出的通配符模式。curl 可以被建构为针对 TLS 使用其自己的名称匹配函数，而不是 TLS 库的函数。此私密通配符匹配函数会错误匹配 IDN（国际域名）主机，并因此接受本应不匹配的模式。IDN 主机名在用于证书检查之前会被转换为域名代码。Puny 编码名称总是以“xn--”开头，且不应允许进行模式匹配，但 curl 中的通配符检查仍可检查“x*”，即使 IDN 名称很可能不包含任何类似“x”的符号亦然。(CVE-2023-28321)

  - curl v8.1.0 之前版本中存在信息泄露漏洞。在进行 HTTP(S) 传输时，如果之前使用相同的句柄发出 `PUT` 请求（使用读取回调 (`CURLOPT_READFUNCTION`)），即使设置了 `CURLOPT_POSTFIELDS` 选项，libcurl 仍可能会错误地使用该回调来请求发送数据。此缺陷可能会使应用程序发生意外并导致其行为不当，在第二次传输中发送错误的数据，或使用释放后的内存或类似内容。从 PUT 更改为 POST 时（此为预期行为），重用句柄的逻辑中存在此问题。(CVE-2023-28322)

  - 当 curl 检索 HTTP 响应时，即会存储传入的标头，以便稍后可以通过 libcurl 标头 API 访问它们。然而，curl 在响应中接受的标头数量或大小并无限制，从而允许恶意服务器流式传输一连串无尽的标头，并最终导致 curl 耗尽堆内存。(CVE-2023-38039)

  - CVE-2023-38545 是 libcurl 和 curl 的 SOCKS5 代理握手中存在的基于堆的缓冲区溢出漏洞。当为 curl 提供一个主机名以传递给长度大于 255 字节的 SOCKS5 代理时，它将切换到本地名称解析，以便在将其传递给 SOCKS5 代理之前解析该地址。但由于 2020 年引入的错误，此本地名称解析可能会因 SOCKS5 握手缓慢而失败，导致 curl 将长度大于 255 字节的主机名传递到目标缓冲区，从而导致堆溢出情形。 CVE-2023-38545 的公告中提供了重定向到特制 URL 的恶意 HTTPS 服务器的示例利用情况。虽然攻击者似乎需要影响 SOCKS5 握手的缓慢程度，但该公告指出，服务器延迟可能足够缓慢，足以触发此错误。(CVE-2023-38545)

  - 如需详细信息，请查看供参考的 CVE 标识符。请注意，远程代码执行的风险仅限于 SOCKS 的使用。(CVE-2023-38546)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程主机上安装的 IBM Engineering Requirements Management DOORS（以前称为 IBM Rational DOORS）版本是 9.7.2.x 之前的 9.7.2.8。因此，它受到 7124058 公告中提及的多个漏洞影响。

  - 1.9.1 之前的 Apache Shiro，在某些 servlet 容器上可能会错误配置 RegexRequestMatcher 以绕过它。在正则表达式中使用带有“.”的 RegExPatternMatcher 的应用程序可能容易受到授权绕过的影响。(CVE-2022-32532)

  - Java OpenWire 协议编组器容易受到远程代码执行的攻击。利用该漏洞，可以通过网络访问 Java 型 OpenWire 代理或客户端的远程攻击者可以通过操纵 OpenWire 协议中的序列化类类型来运行任意 shell 命令，从而导致客户端或代理（分别）实例化类路径上的任何类。建议用户升级到修复了此问题的代理和客户端（版本 5.15.16、5.16.7、5.17.6、5.18.3）。
    (CVE-2023-46604)

  - 2.13.9 之前的 Scala 2.13.x 在其 JAR 文件中存在 Java 反序列化链。它本身无法被利用。只有与应用程序内的 Java 对象反序列化结合使用时才会存在风险。在此类情况下，它会允许攻击者通过小工具链擦除任意文件的内容、建立网络连接或可能运行任意代码（特别是 Function0 函数）。(CVE-2022-36944)

  - IBM Engineering Requirements Management DOORS 9.7.2.7 是一个跨站请求漏洞，该漏洞允许攻击者执行从网站信任用户传输的恶意和未经授权的操作。IBM X-Force ID：251216。(CVE-2023-28949)

  4.14 之前的 CKEditor 4.0 的 HTML 数据处理器中存在跨站脚本 (XSS) 漏洞，该漏洞会允许远程攻击者通过构建的受保护注释 （带有 cke_protected 语法）注入任意 web 脚本。(CVE-2020-9281)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and telnet options during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

ID	名稱	產品	系列	已發布	已更新	嚴重性
173037	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : curl vulnerabilities (USN-5964-1)	Nessus	Ubuntu Local Security Checks	2023/3/20	2024/8/27	high
173044	Slackware Linux 14.0 / 14.1 / 14.2 / 15.0 / current curl Multiple Vulnerabilities (SSA:2023-079-01)	Nessus	Slackware Local Security Checks	2023/3/20	2023/6/1	high
175318	EulerOS 2.0 SP10 : curl (EulerOS-SA-2023-1798)	Nessus	Huawei Local Security Checks	2023/5/9	2023/6/1	high
176939	Amazon Linux 2 : curl (ALAS-2023-2070)	Nessus	Amazon Linux Local Security Checks	2023/6/8	2024/12/11	high
179111	EulerOS Virtualization 3.0.6.0 : curl (EulerOS-SA-2023-2500)	Nessus	Huawei Local Security Checks	2023/7/31	2023/7/31	high
188784	EulerOS 2.0 SP11 : curl (EulerOS-SA-2023-2635)	Nessus	Huawei Local Security Checks	2024/1/16	2024/1/16	high
188827	EulerOS Virtualization 2.11.1 : curl (EulerOS-SA-2023-2719)	Nessus	Huawei Local Security Checks	2024/1/16	2024/1/16	high
194927	Universal Forwarders < 8.1.14, 8.2.0 < 8.2.11, 9.0.0 < 9.0.5 (SVD-2023-0614)	Nessus	CGI abuses	2024/5/2	2024/5/30	critical
185089	RHEL 9：curl (RHSA-2023: 6679)	Nessus	Red Hat Local Security Checks	2023/11/7	2025/3/13	high
191296	CentOS 9：curl-7.76.1-26.el9	Nessus	CentOS Local Security Checks	2024/2/29	2024/4/26	high
194926	Universal Forwarders 8.2.0 < 8.2.12、9.0.0 < 9.0.6、9.1.0 < 9.1.1 (SVD-2023-0809)	Nessus	CGI abuses	2024/5/2	2024/5/30	critical
194919	Splunk Enterprise <8.1.14、8.2.0 < 8.2.11、9.0.0 < 9.0.5 (SVD-2023-0613)	Nessus	CGI abuses	2024/5/2	2024/7/26	critical
182879	GLSA-202310-12 : curl：多个漏洞	Nessus	Gentoo Local Security Checks	2023/10/11	2025/11/6	critical
191754	IBM Engineering Requirements Management DOORS 9.7.2.x < 9.7.2.8 多种漏洞 (7124058)	Nessus	Windows	2024/3/8	2024/3/12	critical
504174	Siemens SIMATIC S7-1500 Improper Neutralization of Special Elements in Output Used by a Downstream Component (CVE-2023-27533)	Tenable OT Security	Tenable.ot	2025/11/13	2025/11/13	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

critical

high

high

critical

critical

critical

critical

high