Test Kennung:	1.3.6.1.4.1.25623.1.1.10.2018.0110
Kategorie:	Mageia Linux Local Security Checks
Titel:	Mageia: Security Advisory (MGASA-2018-0110)
Zusammenfassung:	The remote host is missing an update for the 'curl' package(s) announced via the MGASA-2018-0110 advisory.
Beschreibung:	Summary: The remote host is missing an update for the 'curl' package(s) announced via the MGASA-2018-0110 advisory. Vulnerability Insight: It was reported that reading an HTTP/2 trailer could mess up future trailers since the stored size was one byte less than required. When accessed, the data is read out of bounds and causes either a crash or that the (too large) data gets passed to the libcurl callback. This might lead to a denial-of-service situation or an information disclosure if someone has a service that echoes back or uses the trailers for something (CVE-2018-1000005). When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom Authorization: headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request (CVE-2018-1000008). Affected Software/OS: 'curl' package(s) on Mageia 6. Solution: Please install the updated package(s). CVSS Score: 6.5 CVSS Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2018-1000005 Debian Security Information: DSA-4098 (Google Search) https://www.debian.org/security/2018/dsa-4098 RedHat Security Advisories: RHSA-2019:1543 https://access.redhat.com/errata/RHSA-2019:1543 http://www.securitytracker.com/id/1040273 https://usn.ubuntu.com/3554-1/ Common Vulnerability Exposure (CVE) ID: CVE-2018-1000008 BugTraq ID: 102844 http://www.securityfocus.com/bid/102844
Copyright	Copyright (C) 2022 Greenbone AG

Dies ist nur einer von 145615 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.