7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
8.2 High
AI Score
Confidence
Low
0.003 Low
EPSS
Percentile
69.7%
The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:6157 advisory.
curl < 7.84.0 supports chained HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable links in this decompression chain was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a malloc bomb, makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors. (CVE-2022-32206)
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally widen the permissions for the target file, leaving the updated file accessible to more users than intended. (CVE-2022-32207)
When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly.
This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client. (CVE-2022-32208)
Note that Nessus has not tested for these issues but has instead relied only on the application’s self-reported version number.
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The package checks in this plugin were extracted from
# Rocky Linux Security Advisory RLSA-2022:6157.
##
include('compat.inc');
if (description)
{
script_id(184926);
script_version("1.1");
script_set_attribute(attribute:"plugin_modification_date", value:"2023/11/14");
script_cve_id("CVE-2022-32206", "CVE-2022-32207", "CVE-2022-32208");
script_xref(name:"RLSA", value:"2022:6157");
script_xref(name:"IAVA", value:"2022-A-0255-S");
script_name(english:"Rocky Linux 9 : curl (RLSA-2022:6157)");
script_set_attribute(attribute:"synopsis", value:
"The remote Rocky Linux host is missing one or more security updates.");
script_set_attribute(attribute:"description", value:
"The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the
RLSA-2022:6157 advisory.
- curl < 7.84.0 supports chained HTTP compression algorithms, meaning that a serverresponse can be
compressed multiple times and potentially with different algorithms. The number of acceptable links in
this decompression chain was unbounded, allowing a malicious server to insert a virtually unlimited
number of compression steps.The use of such a decompression chain could result in a malloc bomb,
makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of
memory errors. (CVE-2022-32206)
- When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by
finalizing the operation with a rename from a temporary name to the final target file name.In that rename
operation, it might accidentally *widen* the permissions for the target file, leaving the updated file
accessible to more users than intended. (CVE-2022-32207)
- When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly.
This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject
data to the client. (CVE-2022-32208)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
script_set_attribute(attribute:"see_also", value:"https://errata.rockylinux.org/RLSA-2022:6157");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=2099300");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=2099305");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=2099306");
script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-32207");
script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
script_set_attribute(attribute:"exploit_available", value:"true");
script_set_attribute(attribute:"vuln_publication_date", value:"2022/06/27");
script_set_attribute(attribute:"patch_publication_date", value:"2022/08/24");
script_set_attribute(attribute:"plugin_publication_date", value:"2023/11/07");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:rocky:linux:curl");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:rocky:linux:curl-debuginfo");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:rocky:linux:curl-debugsource");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:rocky:linux:curl-minimal");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:rocky:linux:curl-minimal-debuginfo");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:rocky:linux:libcurl");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:rocky:linux:libcurl-debuginfo");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:rocky:linux:libcurl-devel");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:rocky:linux:libcurl-minimal");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:rocky:linux:libcurl-minimal-debuginfo");
script_set_attribute(attribute:"cpe", value:"cpe:/o:rocky:linux:9");
script_set_attribute(attribute:"generated_plugin", value:"current");
script_set_attribute(attribute:"stig_severity", value:"II");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Rocky Linux Local Security Checks");
script_copyright(english:"This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/local_checks_enabled", "Host/RockyLinux/release", "Host/RockyLinux/rpm-list", "Host/cpu");
exit(0);
}
include('rpm.inc');
if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/RockyLinux/release');
if (isnull(os_release) || 'Rocky Linux' >!< os_release) audit(AUDIT_OS_NOT, 'Rocky Linux');
var os_ver = pregmatch(pattern: "Rocky(?: Linux)? release ([0-9]+(\.[0-9]+)?)", string:os_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Rocky Linux');
os_ver = os_ver[1];
if (! preg(pattern:"^9([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, 'Rocky Linux 9.x', 'Rocky Linux ' + os_ver);
if (!get_kb_item('Host/RockyLinux/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Rocky Linux', cpu);
var pkgs = [
{'reference':'curl-7.76.1-14.el9_0.5', 'cpu':'aarch64', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'curl-7.76.1-14.el9_0.5', 'cpu':'s390x', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'curl-7.76.1-14.el9_0.5', 'cpu':'x86_64', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'curl-debuginfo-7.76.1-14.el9_0.5', 'cpu':'aarch64', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'curl-debuginfo-7.76.1-14.el9_0.5', 'cpu':'s390x', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'curl-debuginfo-7.76.1-14.el9_0.5', 'cpu':'x86_64', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'curl-debugsource-7.76.1-14.el9_0.5', 'cpu':'aarch64', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'curl-debugsource-7.76.1-14.el9_0.5', 'cpu':'s390x', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'curl-debugsource-7.76.1-14.el9_0.5', 'cpu':'x86_64', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'curl-minimal-7.76.1-14.el9_0.5', 'cpu':'aarch64', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'curl-minimal-7.76.1-14.el9_0.5', 'cpu':'s390x', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'curl-minimal-7.76.1-14.el9_0.5', 'cpu':'x86_64', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'curl-minimal-debuginfo-7.76.1-14.el9_0.5', 'cpu':'aarch64', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'curl-minimal-debuginfo-7.76.1-14.el9_0.5', 'cpu':'s390x', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'curl-minimal-debuginfo-7.76.1-14.el9_0.5', 'cpu':'x86_64', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'libcurl-7.76.1-14.el9_0.5', 'cpu':'aarch64', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'libcurl-7.76.1-14.el9_0.5', 'cpu':'i686', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'libcurl-7.76.1-14.el9_0.5', 'cpu':'s390x', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'libcurl-7.76.1-14.el9_0.5', 'cpu':'x86_64', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'libcurl-debuginfo-7.76.1-14.el9_0.5', 'cpu':'aarch64', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'libcurl-debuginfo-7.76.1-14.el9_0.5', 'cpu':'s390x', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'libcurl-debuginfo-7.76.1-14.el9_0.5', 'cpu':'x86_64', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'libcurl-devel-7.76.1-14.el9_0.5', 'cpu':'aarch64', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'libcurl-devel-7.76.1-14.el9_0.5', 'cpu':'i686', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'libcurl-devel-7.76.1-14.el9_0.5', 'cpu':'s390x', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'libcurl-devel-7.76.1-14.el9_0.5', 'cpu':'x86_64', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'libcurl-minimal-7.76.1-14.el9_0.5', 'cpu':'aarch64', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'libcurl-minimal-7.76.1-14.el9_0.5', 'cpu':'i686', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'libcurl-minimal-7.76.1-14.el9_0.5', 'cpu':'s390x', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'libcurl-minimal-7.76.1-14.el9_0.5', 'cpu':'x86_64', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'libcurl-minimal-debuginfo-7.76.1-14.el9_0.5', 'cpu':'aarch64', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'libcurl-minimal-debuginfo-7.76.1-14.el9_0.5', 'cpu':'s390x', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'libcurl-minimal-debuginfo-7.76.1-14.el9_0.5', 'cpu':'x86_64', 'release':'9', 'rpm_spec_vers_cmp':TRUE}
];
var flag = 0;
foreach var package_array ( pkgs ) {
var reference = NULL;
var _release = NULL;
var sp = NULL;
var _cpu = NULL;
var el_string = NULL;
var rpm_spec_vers_cmp = NULL;
var epoch = NULL;
var allowmaj = NULL;
var exists_check = NULL;
if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
if (!empty_or_null(package_array['release'])) _release = 'Rocky-' + package_array['release'];
if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
if (reference && _release && (!exists_check || rpm_exists(release:_release, rpm:exists_check))) {
if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;
}
}
if (flag)
{
security_report_v4(
port : 0,
severity : SECURITY_HOLE,
extra : rpm_report_get()
);
exit(0);
}
else
{
var tested = pkg_tests_get();
if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'curl / curl-debuginfo / curl-debugsource / curl-minimal / etc');
}
Vendor | Product | Version | CPE |
---|---|---|---|
rocky | linux | libcurl-minimal | p-cpe:/a:rocky:linux:libcurl-minimal |
rocky | linux | libcurl-devel | p-cpe:/a:rocky:linux:libcurl-devel |
rocky | linux | libcurl | p-cpe:/a:rocky:linux:libcurl |
rocky | linux | 9 | cpe:/o:rocky:linux:9 |
rocky | linux | libcurl-debuginfo | p-cpe:/a:rocky:linux:libcurl-debuginfo |
rocky | linux | curl | p-cpe:/a:rocky:linux:curl |
rocky | linux | curl-minimal-debuginfo | p-cpe:/a:rocky:linux:curl-minimal-debuginfo |
rocky | linux | libcurl-minimal-debuginfo | p-cpe:/a:rocky:linux:libcurl-minimal-debuginfo |
rocky | linux | curl-debugsource | p-cpe:/a:rocky:linux:curl-debugsource |
rocky | linux | curl-minimal | p-cpe:/a:rocky:linux:curl-minimal |
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32206
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32207
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32208
bugzilla.redhat.com/show_bug.cgi?id=2099300
bugzilla.redhat.com/show_bug.cgi?id=2099305
bugzilla.redhat.com/show_bug.cgi?id=2099306
errata.rockylinux.org/RLSA-2022:6157
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
8.2 High
AI Score
Confidence
Low
0.003 Low
EPSS
Percentile
69.7%