Amazon Linux 2023 : perl-Net-IDN-Encode (ALAS2023-2026-3190)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Amazon Linux 2023 Security Advisory ALAS2023-2026-3190.
##

include('compat.inc');

if (description)
{
  script_id(365261);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/12");

  script_cve_id(
    "CVE-2026-74765",
    "CVE-2026-74766",
    "CVE-2026-87078",
    "CVE-2026-87079",
    "CVE-2026-87080",
    "CVE-2026-87081",
    "CVE-2026-87082"
  );

  script_name(english:"Amazon Linux 2023 : perl-Net-IDN-Encode (ALAS2023-2026-3190)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Amazon Linux 2023 host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3190 advisory.

    Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the
    delta accumulator in encode_punycode.

    The XS backend keeps the punycode delta, and the digit index derived from it, in a signed int. The
    accumulation `delta += (m-n) * (h+1)` has no overflow check, so a large enough code point wraps the delta
    and the digit index leaves the range of the 36-entry digit table. The bound before the final table access
    tests only for an index above 36, so a negative index passes it, as does 36 itself. Perl strings hold code
    points beyond the Unicode range, and one such code point overflows the accumulation on its own. Valid
    input wraps it as well, for example 1927 ASCII letters followed by U+10FFFF. The conversion functions
    encode a label before they check its length, so a long label reaches the encoder through the documented
    API.

    Only the XS backend is affected.

    Encoding an attacker-supplied string copies a byte from outside the digit table into the encoded result or
    crashes the process. (CVE-2026-74765)

    Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded
    code point that reallocates the output buffer in decode_punycode.

    The XS backend inserts each decoded code point into the string buffer of the scalar it returns.
    decode_punycode computes the insertion pointer first and only then grows the buffer when the code point
    does not fit. The growth reallocates the buffer and updates every pointer except the insertion pointer, so
    the move that follows and the write of the code point go through a freed pointer. The buffer starts at
    twice the label length, and a code point above U+FFFF takes four bytes in the output, so a label of such
    code points outgrows it and forces the reallocation.

    Version 2.301, the fix for CVE-2016-15059, introduced the defect. Only the XS backend is affected.

    Decoding an attacker-supplied punycode label reads and writes freed heap memory. (CVE-2026-74766)

    Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected
    label in decode_punycode.

    The XS backend allocates the scalar it returns before it validates the input, sizing the buffer at twice
    the input length. The scalar is released only on the success path, so each of the three croaks that reject
    a label leaves the scalar and its buffer allocated. Nothing bounds the label length in the to-Unicode
    direction, since the 63-byte DNS limit is checked only when converting to ASCII.

    Only the XS backend is affected.

    A sender who supplies invalid labels grows the process by twice the label length per rejected call, with
    no successful call needed. (CVE-2026-87078)

    Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when
    decoding a long label in decode_punycode.

    The XS backend inserts each decoded code point into a UTF-8 buffer and finds the insertion point by
    scanning that buffer from the start, one character at a time. The scan runs once per code point over the
    output built so far, so the cost is quadratic in the label length. The pure-Perl backend downgrades its
    input to bytes so that substr can index it directly, but takes its working copy before the downgrade, so
    when the input carries the UTF-8 flag every substr on the copy scans from the start, with the same
    quadratic cost.

    Nothing bounds the label length in the to-Unicode direction. The 63-byte DNS limit is checked only when
    converting to ASCII, so domain_to_unicode and uts46_to_unicode pass an attacker-supplied label of any
    length to the decoder. (CVE-2026-87079)

    Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a
    character it never encoded in decode_punycode.

    The pure-Perl decoder reads one digit at a time with four-argument substr and tests the result with
    defined to detect the end of the input. substr on an exhausted string returns the empty string rather than
    undef, so decoding continues past the end. The empty string converts to a digit value below the range,
    reducing the accumulator, and the decoder derives one extra code point and its position from it. The
    result is deterministic. The XS backend rejects the same label.

    Net::IDN::Punycode uses this backend wherever the XS does not build.

    The two backends disagree about what such a label means, so a sender can pick a label that one
    installation resolves to a name and another rejects. (CVE-2026-87080)

    Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an
    overlong label before the length check in to_ascii.

    to_ascii punycode encodes each label and only then applies the 63-byte DNS limit. encode_punycode in both
    backends follows the sample implementation in RFC 3492, whose outer loop runs once per distinct non-ASCII
    code point and scans the whole input each round, so a label of distinct non-ASCII characters costs the
    square of its length before the limit rejects it. Every ASCII conversion in the distribution, including
    domain_to_ascii and email_to_ascii, goes through to_ascii. (CVE-2026-87081)

    Net::IDN::Punycode versions before 2.590 for Perl hang, crash or return a wrong label via unvalidated
    malformed UTF-8 in encode_punycode.

    Neither backend checks that its input is well-formed UTF-8, so a string with the UTF-8 flag set over
    malformed bytes, as the :utf8 PerlIO layer produces from any malformed input, reaches the encoder
    unchecked. On perl 5.32 and later the XS backend reports a malformed sequence with a length of
    `(STRLEN)-1`, so the scan steps back one byte instead of forward and never ends. On earlier perls the XS
    returns a valid label for a different name. The pure-Perl backend runs a regex over the flagged string.
    Depending on the bytes, it aborts with SIGBUS on perl 5.28 and later, dies with a panic, or returns a
    wrong label.

    The documented conversion functions match the label against Unicode properties first and that match dies
    on such a string, so only a direct call to encode_punycode reaches the defect. The decoder is not
    affected.

    A direct caller encoding attacker-supplied bytes hangs, crashes or gets a label for a name the input never
    held. (CVE-2026-87082)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com//AL2023/ALAS2023-2026-3190.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/faqs.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-74765.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-74766.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-87078.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-87079.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-87080.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-87081.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-87082.html");
  script_set_attribute(attribute:"solution", value:
"Run 'dnf update perl-Net-IDN-Encode --releasever 2023.12.20261012' or
  or 'dnf update --advisory ALAS2023-2026-3190 --releasever 2023.12.20261012' to update your system.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-87080");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/22");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/12");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:perl-Net-IDN-Encode");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:perl-Net-IDN-Encode-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:perl-Net-IDN-Encode-debugsource");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux:2023");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Amazon Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");

  exit(0);
}

include("rpm2.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var alas_release = get_kb_item("Host/AmazonLinux/release");
if (isnull(alas_release) || !strlen(alas_release)) audit(AUDIT_OS_NOT, "Amazon Linux");
var os_ver = pregmatch(pattern: "^AL(A|\d+|-\d+)", string:alas_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
os_ver = os_ver[1];
if (os_ver != "-2023")
{
  if (os_ver == 'A') os_ver = 'AMI';
  audit(AUDIT_OS_NOT, "Amazon Linux 2023", "Amazon Linux " + os_ver);
}

if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var pkgs = [
    {'reference':'perl-Net-IDN-Encode-2.590-1.amzn2023.0.1', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'perl-Net-IDN-Encode-2.590-1.amzn2023.0.1', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'perl-Net-IDN-Encode-debuginfo-2.590-1.amzn2023.0.1', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'perl-Net-IDN-Encode-debuginfo-2.590-1.amzn2023.0.1', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'perl-Net-IDN-Encode-debugsource-2.590-1.amzn2023.0.1', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'perl-Net-IDN-Encode-debugsource-2.590-1.amzn2023.0.1', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE}
];

var flag = 0;
foreach var package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var sp = NULL;
  var _cpu = NULL;
  var el_string = NULL;
  var rpm_spec_vers_cmp = NULL;
  var epoch = NULL;
  var allowmaj = NULL;
  var exists_check = NULL;
  var cves = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
  if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
  if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
  if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
  if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
  if (!empty_or_null(package_array['cves'])) cves = package_array['cves'];
  if (reference && _release && (!exists_check || rpm_exists(release:_release, rpm:exists_check))) {
    if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "perl-Net-IDN-Encode / perl-Net-IDN-Encode-debuginfo / perl-Net-IDN-Encode-debugsource");
}