Amazon Linux 2023 : jackson-core (ALAS2023-2026-3188)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Amazon Linux 2023 Security Advisory ALAS2023-2026-3188.
##

include('compat.inc');

if (description)
{
  script_id(365243);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/12");

  script_cve_id("CVE-2026-89407", "CVE-2026-89425");

  script_name(english:"Amazon Linux 2023 : jackson-core (ALAS2023-2026-3188)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Amazon Linux 2023 host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3188 advisory.

    NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates stringified numbers with two
    regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[\.]?[0-9]+([eE][+-]?[0-9]+)?), present since 2.17.0, and
    PATTERN_FLOAT_TRAILING_DOT, added in 2.17.2. PATTERN_FLOAT places adjacent quantifiers over the same
    character class -- an optional [0-9]* run, an optional dot, then a required [0-9]+ run -- so input that
    ultimately fails to match forces Java's backtracking engine to retry every possible split point of the
    digit run.

    Matching cost therefore grows with the square of the input length.

    An attacker who can supply JSON that an application deserializes into a numeric target type reaches this
    method through jackson-databind's default String-to-number coercion (StdDeserializer and
    NumberDeserializers for BigDecimal, BigInteger, Double and Float).

    Because StreamReadConstraints.maxStringLength defaults to 20,000,000 characters, no constraint bounds the
    input before it reaches the regex.

    Testing by the reporter confirmed O(n^2) growth across five consecutive input-size doublings, with a
    single 160,000-character string consuming roughly 74 seconds in one call; a small number of concurrent
    requests of ordinary body size can therefore exhaust a server's request-handling thread pool.

    The affected method does not exist before 2.17.0, so 2.16.x and earlier releases are not affected.

    The fix replaces both regular expressions with a hand-rolled single-pass scan. (CVE-2026-89407)

    UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text
    for its error message by appending Java identifier characters to a StringBuilder in a loop that has no
    upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never
    consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a
    parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No
    StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at
    all, and maxStringLength does not cover this path because the accumulation bypasses
    ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a
    20-million-character malformed token on the DataInput path, against 367 characters for identical input on
    the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char
    expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError
    for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput);
    releases before 2.8.0 do not contain the affected class. (CVE-2026-89425)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com//AL2023/ALAS2023-2026-3188.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/faqs.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89407.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-89425.html");
  script_set_attribute(attribute:"solution", value:
"Run 'dnf update jackson-core --releasever 2023.12.20261012' or
  or 'dnf update --advisory ALAS2023-2026-3188 --releasever 2023.12.20261012' to update your system.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-89425");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/22");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/12");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:jackson-core");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux:2023");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Amazon Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");

  exit(0);
}

include("rpm2.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var alas_release = get_kb_item("Host/AmazonLinux/release");
if (isnull(alas_release) || !strlen(alas_release)) audit(AUDIT_OS_NOT, "Amazon Linux");
var os_ver = pregmatch(pattern: "^AL(A|\d+|-\d+)", string:alas_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
os_ver = os_ver[1];
if (os_ver != "-2023")
{
  if (os_ver == 'A') os_ver = 'AMI';
  audit(AUDIT_OS_NOT, "Amazon Linux 2023", "Amazon Linux " + os_ver);
}

if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var pkgs = [
    {'reference':'jackson-core-2.21.7-1.amzn2023.0.1', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE}
];

var flag = 0;
foreach var package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var sp = NULL;
  var _cpu = NULL;
  var el_string = NULL;
  var rpm_spec_vers_cmp = NULL;
  var epoch = NULL;
  var allowmaj = NULL;
  var exists_check = NULL;
  var cves = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
  if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
  if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
  if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
  if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
  if (!empty_or_null(package_array['cves'])) cves = package_array['cves'];
  if (reference && _release && (!exists_check || rpm_exists(release:_release, rpm:exists_check))) {
    if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "jackson-core");
}