| Package | Affected versions | Patched versions |
|---|---|---|
| curl | ≥ 7.7, ≤ 7.76.1 | |
| communications cloud native core binding support function | = 1.11.0 | |
| communications cloud native core network function cloud native environment | = 1.10.0 | |
| communications cloud native core network repository function | = 1.15.0= 1.15.1 | |
| communications cloud native core network slice selection function | = 1.8.0 | |
| communications cloud native core service communication proxy | = 1.15.0 | |
| essbase | ≥ 21.0, < 21.3< 11.1.2.4.047 | 21.311.1.2.4.047 |
| mysql server | ≥ 8.0.15, < 8.0.25< 5.7.34 | 8.0.255.7.34 |
| sinec infrastructure network services | < 1.0.1.1 | 1.0.1.1 |
| universal forwarder | = 9.1.0≥ 8.2.0, < 8.2.12≥ 9.0.0, < 9.0.6 | 8.2.129.0.6 |
curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free