Photon OS 5.0: Curl PHSA-2024-5.0-0392

An update of the curl package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-0392. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2024-8096 affecting package curl for versions less than 8.8.0-3

CVE-2024-8096 affecting package curl for versions less than 8.8.0-3. A patched version of the package is available...

curl: CVE-2024-11053: netrc + redirect credential leak

CVE-2024-11053 was a logic flaw in Curl that resulted in a credential leak during redirects. The issue was caused by the way Curl processed netrc credentials when performing redirects. Under certain conditions, the redirect passed along credentials specified for the original host to the redirecti...

EulerOS 2.0 SP9 : curl (EulerOS-SA-2024-2809)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : libcurl's ASN1 parser code has the GTime2str function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field,...

EulerOS 2.0 SP9 : curl (EulerOS-SA-2024-2825)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : libcurl's ASN1 parser code has the GTime2str function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field,...

OPENSUSE-SU-2024:14476-1 curl-8.11.0-1.1 on GA media

These are all security issues fixed in the curl-8.11.0-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2024-9413

Name of the Vulnerable Software and Affected Versions: curl versions 6.5 through 8.11.0 Description: The issue arises when curl is used with a .netrc file for credentials and follows HTTP redirects. Under certain circumstances, curl could leak the password used for the first host to the followed-...

Curl 7.74.0 < 8.10.1 Input Misinterpretation (CVE-2024-9681)

The version of Curl installed on the remote host is between 7.74.0 and prior to 8.10.1. It is, therefore, affected by a potential minor DoS security problem when trying to use HTTPS when that no longer works or a cleartext transmission of data that was otherwise intended to possibly be protected...

openSUSE Security Advisory (SUSE-SU-2024:3925-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP10 : curl (EulerOS-SA-2024-2882)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is...

openSUSE Security Advisory (SUSE-SU-2024:3926-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE CVE-2024-9681

When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects curl using applications that enable HSTS and use URLs with the insecure HTTP:// scheme and perform transfers with host...

SUSE SLED15: curl / libcurl-devel / libcurl-devel-32bit / libcurl4 / etc (SUSE-SU-2024:3926-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:3926-1 advisory. - CVE-2024-9681: Fixed HSTS subdomain overwrites parent cache entry bsc1232528 Tenable has extracted the...

The complexity of implementing the HSTS mechanism through the command-line tool `curl` allows attackers to carry out “man-in-the-middle” attacks.

The vulnerability of the HSTS HTTP Strict Transport Security mechanism’s implementation in the curl command-line utility exists due to a bug in the HSTS cache implementation. Exploiting this vulnerability allows a remote attacker to carry out “man-in-the-middle” type attacks...

SUSE SLES12 Security Update : curl (SUSE-SU-2024:3927-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2024:3927-1 advisory. - CVE-2024-9681: Fixed HSTS subdomain overwrites parent cache entry bsc1232528 Tenable has extracted the preceding description block directly from the...

Security update for curl

This update for curl fixes the following issues: CVE-2024-9681: Fixed HSTS subdomain overwrites parent cache entry bsc1232528 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the comma...

Security update for curl

This update for curl fixes the following issues: CVE-2024-9681: Fixed HSTS subdomain overwrites parent cache entry bsc1232528 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the comma...

Security update for curl

This update for curl fixes the following issues: CVE-2024-9681: Fixed HSTS subdomain overwrites parent cache entry bsc1232528 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the comma...

SUSE-SU-2024:3925-1 Security update for curl

This update for curl fixes the following issues: - CVE-2024-9681: Fixed HSTS subdomain overwrites parent cache entry bsc1232528...

AZL-52335 CVE-2024-9681 affecting package curl for versions less than 8.8.0-5

When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects curl using applications that enable HSTS and use URLs with the insecure HTTP:// scheme and perform transfers with host...