Amazon Linux 2023 : libsoup, libsoup-devel (ALAS2023-2025-1310)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Amazon Linux 2023 Security Advisory ALAS2023-2025-1310.
##

include('compat.inc');

if (description)
{
  script_id(277796);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/24");

  script_cve_id("CVE-2025-4476", "CVE-2025-4945", "CVE-2025-4969");
  script_xref(name:"IAVA", value:"2025-A-0780-S");

  script_name(english:"Amazon Linux 2023 : libsoup, libsoup-devel (ALAS2023-2025-1310)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Amazon Linux 2023 host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1310 advisory.

    A denial-of-service vulnerability has been identified in the libsoup HTTP client library. This flaw can be
    triggered when a libsoup client receives a 401 (Unauthorized) HTTP response containing a specifically
    crafted domain parameter within the WWW-Authenticate header. Processing this malformed header can lead to
    a crash of the client application using libsoup. An attacker could exploit this by setting up a malicious
    HTTP server. If a user's application using the vulnerable libsoup library connects to this malicious
    server, it could result in a denial-of-service. Successful exploitation requires tricking a user's client
    application into connecting to the attacker's malicious server. (CVE-2025-4476)

    A flaw was found in the cookie parsing logic of the libsoup HTTP library, used in GNOME applications and
    other software. The vulnerability arises when processing the expiration date of cookies, where a specially
    crafted value can trigger an integer overflow. This may result in undefined behavior, allowing an attacker
    to bypass cookie expiration logic, causing persistent or unintended cookie behavior. The issue stems from
    improper validation of large integer inputs during date arithmetic operations within the cookie parsing
    routines. (CVE-2025-4945)

    A vulnerability was found in the libsoup package. This flaw stems from its failure to correctly verify the
    termination of multipart HTTP messages. This can allow a remote attacker to send a specially crafted
    multipart HTTP body, causing the libsoup-consuming server to read beyond its allocated memory boundaries
    (out-of-bounds read). (CVE-2025-4969)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com//AL2023/ALAS2023-2025-1310.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/faqs.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2025-4476.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2025-4945.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2025-4969.html");
  script_set_attribute(attribute:"solution", value:
"Run 'dnf update libsoup --releasever 2023.9.20251208' or
  or 'dnf update --advisory ALAS2023-2025-1310 --releasever 2023.9.20251208' to update your system.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-4969");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/05/16");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/12/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/12/09");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:libsoup");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:libsoup-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:libsoup-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:libsoup-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:libsoup-doc");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux:2023");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Amazon Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");

  exit(0);
}

include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var alas_release = get_kb_item("Host/AmazonLinux/release");
if (isnull(alas_release) || !strlen(alas_release)) audit(AUDIT_OS_NOT, "Amazon Linux");
var os_ver = pregmatch(pattern: "^AL(A|\d+|-\d+)", string:alas_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
os_ver = os_ver[1];
if (os_ver != "-2023")
{
  if (os_ver == 'A') os_ver = 'AMI';
  audit(AUDIT_OS_NOT, "Amazon Linux 2023", "Amazon Linux " + os_ver);
}

if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var pkgs = [
    {'reference':'libsoup-2.72.0-6.amzn2023.0.8', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libsoup-2.72.0-6.amzn2023.0.8', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libsoup-debuginfo-2.72.0-6.amzn2023.0.8', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libsoup-debuginfo-2.72.0-6.amzn2023.0.8', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libsoup-debugsource-2.72.0-6.amzn2023.0.8', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libsoup-debugsource-2.72.0-6.amzn2023.0.8', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libsoup-devel-2.72.0-6.amzn2023.0.8', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libsoup-devel-2.72.0-6.amzn2023.0.8', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libsoup-doc-2.72.0-6.amzn2023.0.8', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE}
];

var flag = 0;
foreach var package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var sp = NULL;
  var _cpu = NULL;
  var el_string = NULL;
  var rpm_spec_vers_cmp = NULL;
  var epoch = NULL;
  var allowmaj = NULL;
  var exists_check = NULL;
  var cves = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
  if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
  if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
  if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
  if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
  if (!empty_or_null(package_array['cves'])) cves = package_array['cves'];
  if (reference && _release && (!exists_check || rpm_exists(release:_release, rpm:exists_check))) {
    if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libsoup / libsoup-debuginfo / libsoup-debugsource / etc");
}