Test ID:	1.3.6.1.4.1.25623.1.1.12.2023.5894.1
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-5894-1)
Summary:	The remote host is missing an update for the 'curl' package(s) announced via the USN-5894-1 advisory.
Description:	Summary: The remote host is missing an update for the 'curl' package(s) announced via the USN-5894-1 advisory. Vulnerability Insight: Harry Sintonen and Tomas Hoger discovered that curl incorrectly handled TELNET connections when the -t option was used on the command line. Uninitialized data possibly containing sensitive information could be sent to the remote server, contrary to expectations. This issue was only fixed in Ubuntu 14.04 ESM. (CVE-2021-22898, CVE-2021-22925) It was discovered that curl incorrectly handled denials when using HTTP proxies. A remote attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2022-43552) Affected Software/OS: 'curl' package(s) on Ubuntu 14.04, Ubuntu 16.04. Solution: Please install the updated package(s). CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2021-22898 https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf Debian Security Information: DSA-5197 (Google Search) https://www.debian.org/security/2022/dsa-5197 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FRUCW2UVNYUDZF72DQLFQR4PJEC6CF7V/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/POOC3UV7V6L4CJ5KA2PTWTNUV5Y72T3Q/ https://curl.se/docs/CVE-2021-22898.html https://github.com/curl/curl/commit/39ce47f219b09c380b81f89fe54ac586c8db6bde https://hackerone.com/reports/1176461 https://www.oracle.com//security-alerts/cpujul2021.html https://www.oracle.com/security-alerts/cpuapr2022.html https://www.oracle.com/security-alerts/cpujan2022.html https://lists.debian.org/debian-lts-announce/2021/08/msg00017.html https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c@%3Cissues.guacamole.apache.org%3E http://www.openwall.com/lists/oss-security/2021/07/21/4 Common Vulnerability Exposure (CVE) ID: CVE-2021-22925 https://security.netapp.com/advisory/ntap-20210902-0003/ https://support.apple.com/kb/HT212804 https://support.apple.com/kb/HT212805 http://seclists.org/fulldisclosure/2021/Sep/39 http://seclists.org/fulldisclosure/2021/Sep/40 https://security.gentoo.org/glsa/202212-01 https://hackerone.com/reports/1223882 https://www.oracle.com/security-alerts/cpuoct2021.html Common Vulnerability Exposure (CVE) ID: CVE-2022-43552 http://seclists.org/fulldisclosure/2023/Mar/17 https://security.gentoo.org/glsa/202310-12 https://hackerone.com/reports/1764858
Copyright	Copyright (C) 2023 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.