Amazon Linux 2023 : curl, curl-minimal, libcurl (ALAS2023-2026-2132)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Amazon Linux 2023 Security Advisory ALAS2023-2026-2132.
##

include('compat.inc');

if (description)
{
  script_id(345801);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/14");

  script_cve_id(
    "CVE-2026-8286",
    "CVE-2026-8458",
    "CVE-2026-8924",
    "CVE-2026-8925",
    "CVE-2026-8926",
    "CVE-2026-8927",
    "CVE-2026-8932",
    "CVE-2026-9079",
    "CVE-2026-9080",
    "CVE-2026-9545",
    "CVE-2026-9547",
    "CVE-2026-10536",
    "CVE-2026-11586",
    "CVE-2026-11856",
    "CVE-2026-12064"
  );
  script_xref(name:"IAVA", value:"2026-A-0627-S");

  script_name(english:"Amazon Linux 2023 : curl, curl-minimal, libcurl (ALAS2023-2026-2132)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Amazon Linux 2023 host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2132 advisory.

    A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-
    dependency tree via CURLOPT_STREAM_DEPENDS or CURLOPT_STREAM_DEPENDS_E, subsequently invokes
    curl_easy_reset(), and finally terminates the handle with curl_easy_cleanup(). During this final cleanup
    phase, libcurl attempts to access and modify an internal structure that was already freed during the reset
    operation. (CVE-2026-10536)

    By default, curl automatically responds to WebSocket PING frames. Because curl lacks an upper bound on
    memory allocation for unacknowledged frames, a malicious server can exhaust all available memory by
    flooding curl with rapid, sequential PING messages. (CVE-2026-11586)

    Successfully using libcurl to do a transfer to a specific HTTP origin (hostA) with Digest authentication
    and then changing the origin to a different one (hostB) for a second transfer, reusing the same handle,
    makes libcurl wrongly pass on the Authorization: header field meant for hostA, to hostB. (CVE-2026-11856)

    When a user invokes curl using a schemeless URL combined with --proto-default sftp (or scp), a disconnect
    occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which
    erroneously bypasses the initialization of critical SSH security options like
    CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the libcurl runtime
    successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes the connection via SFTP/SCP as specified.
    Because the tool layer skipped the security configuration, these SSH host verification options are
    silently omitted, causing curl to connect to an unverified SSH remote host without throwing an error.
    (CVE-2026-12064)

    A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an
    existing live connection even though the TLS configuration mismatches so it should not. (CVE-2026-8286)

    libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated
    ones, even when they are set to use different services.

    libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection
    to avoid overhead.

    When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request
    that was issued by an application could wrongfully reuse an existing connection to the same server that
    was authenticated using different services. (CVE-2026-8458)

    A flaw in curl's cookie parsing logic allows a malicious HTTP server to set super cookies that bypass
    the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl
    subsequently scopes and transmits to unrelated third-party domains. (CVE-2026-8924)

    The curl logic that works with SASL authentication could end up cleaning up the GSASL context twice
    without clearing the pointer in between, making it free() the same pointer twice. (CVE-2026-8925)

    When asking curl to use a .netrc file to find credentials and at the same time specifying a URL with a
    username (without a password), like https://[email protected]/, curl could wrongly get and use the password
    for another user set in the .netrc file for that host if such a one exists and there is no match for the
    specified user. (CVE-2026-8926)

    When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration,
    libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial
    transfer authenticates against proxyA using Digest auth, a subsequent transfer routed through proxyB
    erroneously leaks the Proxy-Authorization: header intended solely for proxyA. (CVE-2026-8927)

    libcurl would reuse a previously created connection even when some mTLS config related option had been
    changed that should have prohibited reuse.

    libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of
    them matches the setup. However, some TLS settings related to client certificates were left out from the
    configuration match checks, making them match too easily. In particular options related to the private
    key. (CVE-2026-8932)

    libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so,
    leaving the old credentials around to get used for subsequent transfers that should not know nor use them.
    (CVE-2026-9079)

    Calling curl_easy_pause() within the event-based CURLMOPT_SOCKETFUNCTION callback triggers a use-after-
    free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately
    after that pointer's memory has been freed. (CVE-2026-9080)

    In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a
    second transfer to the same site it has been replaced by the attacker's impostor machine - without a valid
    certificate.

    When libcurl returns to the hostname the second time with a cached SSL session
    (CURLOPT_SSL_SESSIONID_CACHE is not disabled) and early data enabled (the CURLSSLOPT_EARLYDATA bit is set
    in CURLOPT_SSL_OPTIONS), libcurl might send off the second request's bytes on that new connection before
    enforcing the certificate verification failure. Potentially leaking sensitive information. (CVE-2026-9545)

    When a libcurl-based application performs transfers via SCP:// or SFTP:// and utilizes the
    CURLOPT_SSH_KEYFUNCTION callback, it may silently accept an untrusted server. This vulnerability occurs
    when a server presents a host key type that does not match the specific key type already recorded for that
    host in the known_hosts file. Instead of rejecting the mismatch, the callback mechanism fails to properly
    enforce the restriction, allowing the connection to succeed without warning and risking a potential man-
    in-the-middle attack. (CVE-2026-9547)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com//AL2023/ALAS2023-2026-2132.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/faqs.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-10536.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-11586.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-11856.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-12064.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-8286.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-8458.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-8924.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-8925.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-8926.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-8927.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-8932.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-9079.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-9080.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-9545.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-9547.html");
  script_set_attribute(attribute:"solution", value:
"Run 'dnf update curl --releasever 2023.12.20260914' or
  or 'dnf update --advisory ALAS2023-2026-2132 --releasever 2023.12.20260914' to update your system.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-9079");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/14");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:curl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:curl-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:curl-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:curl-minimal");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:curl-minimal-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:libcurl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:libcurl-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:libcurl-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:libcurl-minimal");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:libcurl-minimal-debuginfo");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux:2023");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Amazon Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");

  exit(0);
}

include("rpm2.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var alas_release = get_kb_item("Host/AmazonLinux/release");
if (isnull(alas_release) || !strlen(alas_release)) audit(AUDIT_OS_NOT, "Amazon Linux");
var os_ver = pregmatch(pattern: "^AL(A|\d+|-\d+)", string:alas_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
os_ver = os_ver[1];
if (os_ver != "-2023")
{
  if (os_ver == 'A') os_ver = 'AMI';
  audit(AUDIT_OS_NOT, "Amazon Linux 2023", "Amazon Linux " + os_ver);
}

if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var pkgs = [
    {'reference':'curl-8.21.0-5.amzn2023.0.1', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'curl-8.21.0-5.amzn2023.0.1', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'curl-debuginfo-8.21.0-5.amzn2023.0.1', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'curl-debuginfo-8.21.0-5.amzn2023.0.1', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'curl-debugsource-8.21.0-5.amzn2023.0.1', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'curl-debugsource-8.21.0-5.amzn2023.0.1', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'curl-minimal-8.21.0-5.amzn2023.0.1', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'curl-minimal-8.21.0-5.amzn2023.0.1', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'curl-minimal-debuginfo-8.21.0-5.amzn2023.0.1', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'curl-minimal-debuginfo-8.21.0-5.amzn2023.0.1', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libcurl-8.21.0-5.amzn2023.0.1', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libcurl-8.21.0-5.amzn2023.0.1', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libcurl-debuginfo-8.21.0-5.amzn2023.0.1', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libcurl-debuginfo-8.21.0-5.amzn2023.0.1', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libcurl-devel-8.21.0-5.amzn2023.0.1', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libcurl-devel-8.21.0-5.amzn2023.0.1', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libcurl-minimal-8.21.0-5.amzn2023.0.1', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libcurl-minimal-8.21.0-5.amzn2023.0.1', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libcurl-minimal-debuginfo-8.21.0-5.amzn2023.0.1', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libcurl-minimal-debuginfo-8.21.0-5.amzn2023.0.1', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE}
];

var flag = 0;
foreach var package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var sp = NULL;
  var _cpu = NULL;
  var el_string = NULL;
  var rpm_spec_vers_cmp = NULL;
  var epoch = NULL;
  var allowmaj = NULL;
  var exists_check = NULL;
  var cves = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
  if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
  if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
  if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
  if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
  if (!empty_or_null(package_array['cves'])) cves = package_array['cves'];
  if (reference && _release && (!exists_check || rpm_exists(release:_release, rpm:exists_check))) {
    if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "curl / curl-debuginfo / curl-debugsource / etc");
}