Test ID:	1.3.6.1.4.1.25623.1.1.2.2022.2491
Category:	Huawei EulerOS Local Security Checks
Title:	Huawei EulerOS: Security Advisory for curl (EulerOS-SA-2022-2491)
Summary:	The remote host is missing an update for the Huawei EulerOS 'curl' package(s) announced via the EulerOS-SA-2022-2491 advisory.
Description:	Summary: The remote host is missing an update for the Huawei EulerOS 'curl' package(s) announced via the EulerOS-SA-2022-2491 advisory. Vulnerability Insight: A malicious server can use the `PASV` response to trick curl into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions. If curl operates on a URL provided by a user, a user can exploit that and pass in a URL to a malicious FTP server instance without needing any server breach to perform the attack.(CVE-2020-8284) Affected Software/OS: 'curl' package(s) on Huawei EulerOS Virtualization 3.0.6.6. Solution: Please install the updated package(s). CVSS Score: 4.3 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2020-8284 https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf https://security.netapp.com/advisory/ntap-20210122-0007/ https://support.apple.com/kb/HT212325 https://support.apple.com/kb/HT212326 https://support.apple.com/kb/HT212327 Debian Security Information: DSA-4881 (Google Search) https://www.debian.org/security/2021/dsa-4881 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/ https://security.gentoo.org/glsa/202012-14 https://curl.se/docs/CVE-2020-8284.html https://hackerone.com/reports/1040166 https://www.oracle.com//security-alerts/cpujul2021.html https://www.oracle.com/security-alerts/cpuApr2021.html https://www.oracle.com/security-alerts/cpuapr2022.html https://www.oracle.com/security-alerts/cpujan2022.html https://lists.debian.org/debian-lts-announce/2020/12/msg00029.html
Copyright	Copyright (C) 2022 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.