Amazon Linux 2023 : libsoup, libsoup-devel (ALAS2023-2026-3212)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Amazon Linux 2023 Security Advisory ALAS2023-2026-3212.
##

include('compat.inc');

if (description)
{
  script_id(365275);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/12");

  script_cve_id(
    "CVE-2026-15714",
    "CVE-2026-66337",
    "CVE-2026-66338",
    "CVE-2026-102556",
    "CVE-2026-102557",
    "CVE-2026-102558",
    "CVE-2026-102559",
    "CVE-2026-102560",
    "CVE-2026-103399"
  );
  script_xref(name:"IAVA", value:"2026-A-0894");

  script_name(english:"Amazon Linux 2023 : libsoup, libsoup-devel (ALAS2023-2026-3212)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Amazon Linux 2023 host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3212 advisory.

    A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection
    emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes.
    Applications connecting a handler that follows the documented GBytes API can trigger heap corruption or a
    crash upon receiving a crafted Pong. (CVE-2026-102556)

    A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup
    did not adequately cap total message size against the limits of the underlying buffer type. A remote peer
    could send fragments that caused size truncation while the implementation still used the full length,
    leading to heap corruption or a crash. (CVE-2026-102557)

    A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection
    could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped,
    causing a heap buffer overflow while reading frame data. (CVE-2026-102558)

    A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing
    payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine
    still used the full length, causing a heap buffer overflow. (CVE-2026-102559)

    A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large
    outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write
    past the allocated buffer and resulting in a heap buffer overflow. (CVE-2026-102560)

    A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Expect:
    100-continue and a request body, and SoupServer returns an early final (non-1xx) response before the body
    is read, the server neither drains the declared body bytes nor closes the connection. On a keep-alive
    connection, those leftover bytes are interpreted as a subsequent HTTP request. A remote, unauthenticated
    attacker can place a complete HTTP request in the body and cause SoupServer to process that smuggled
    request, leading to unintended request handling. (CVE-2026-103399)

    An out-of-bounds read vulnerability was found in libsoup's multipart processing subsystem. The flaw exists
    in the soup_multipart_input_stream_read_headers() function inside soup-multipart-input-stream.c, which
    does not adequately restrict or validate the size of incoming multipart boundary strings. When processing
    a crafted HTTP response containing a malformed or oversized boundary parameter, the internal stream reader
    reads past the allocated buffer bounds. A remote, unauthenticated attacker can exploit this behavior to
    cause a service denial (DoS) through application failure or potentially read fragments of unauthorized
    memory metadata. (CVE-2026-15714)

    A flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_read_until()
    function causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can
    exploit this by sending a crafted multipart response, potentially causing the client application to crash
    or disclose sensitive heap memory. (CVE-2026-66337)

    A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for
    chunk sizes that silently accepts inputs violating RFC 9112, including leading whitespace, plus sign
    prefixes, and trailing invalid characters. When libsoup operates behind a strict frontend proxy, this
    parsing differential can be exploited to smuggle HTTP requests. (CVE-2026-66338)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com//AL2023/ALAS2023-2026-3212.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/faqs.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-102556.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-102557.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-102558.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-102559.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-102560.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-103399.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-15714.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-66337.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-66338.html");
  script_set_attribute(attribute:"solution", value:
"Run 'dnf update libsoup --releasever 2023.12.20261012' or
  or 'dnf update --advisory ALAS2023-2026-3212 --releasever 2023.12.20261012' to update your system.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-66338");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/12");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:libsoup");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:libsoup-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:libsoup-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:libsoup-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:libsoup-doc");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux:2023");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Amazon Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");

  exit(0);
}

include("rpm2.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var alas_release = get_kb_item("Host/AmazonLinux/release");
if (isnull(alas_release) || !strlen(alas_release)) audit(AUDIT_OS_NOT, "Amazon Linux");
var os_ver = pregmatch(pattern: "^AL(A|\d+|-\d+)", string:alas_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
os_ver = os_ver[1];
if (os_ver != "-2023")
{
  if (os_ver == 'A') os_ver = 'AMI';
  audit(AUDIT_OS_NOT, "Amazon Linux 2023", "Amazon Linux " + os_ver);
}

if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var pkgs = [
    {'reference':'libsoup-2.72.0-6.amzn2023.0.16', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libsoup-2.72.0-6.amzn2023.0.16', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libsoup-debuginfo-2.72.0-6.amzn2023.0.16', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libsoup-debuginfo-2.72.0-6.amzn2023.0.16', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libsoup-debugsource-2.72.0-6.amzn2023.0.16', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libsoup-debugsource-2.72.0-6.amzn2023.0.16', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libsoup-devel-2.72.0-6.amzn2023.0.16', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libsoup-devel-2.72.0-6.amzn2023.0.16', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libsoup-doc-2.72.0-6.amzn2023.0.16', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE}
];

var flag = 0;
foreach var package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var sp = NULL;
  var _cpu = NULL;
  var el_string = NULL;
  var rpm_spec_vers_cmp = NULL;
  var epoch = NULL;
  var allowmaj = NULL;
  var exists_check = NULL;
  var cves = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
  if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
  if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
  if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
  if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
  if (!empty_or_null(package_array['cves'])) cves = package_array['cves'];
  if (reference && _release && (!exists_check || rpm_exists(release:_release, rpm:exists_check))) {
    if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libsoup / libsoup-debuginfo / libsoup-debugsource / etc");
}