Amazon Linux 2 : libsoup (ALAS-2026-3970)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Amazon Linux 2 Security Advisory ALAS-2026-3970.
##

include('compat.inc');

if (description)
{
  script_id(365200);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/12");

  script_cve_id(
    "CVE-2026-0716",
    "CVE-2026-12478",
    "CVE-2026-12547",
    "CVE-2026-12548",
    "CVE-2026-12549",
    "CVE-2026-66337",
    "CVE-2026-66338",
    "CVE-2026-66339",
    "CVE-2026-77014",
    "CVE-2026-77680"
  );
  script_xref(name:"IAVA", value:"2026-A-0139-S");
  script_xref(name:"IAVA", value:"2026-A-0555-S");
  script_xref(name:"IAVA", value:"2026-A-0894");

  script_name(english:"Amazon Linux 2 : libsoup (ALAS-2026-3970)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Amazon Linux 2 host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The version of libsoup installed on the remote host is prior to 2.56.0-6. It is, therefore, affected by multiple
vulnerabilities as referenced in the ALAS2-2026-3970 advisory.

    OOB Read via Integer Overflow on libsoup through libsoup/websocket/soup-websocket-connection.c via
    process_frame() leads to Undefined Behavior (CVE-2026-0716)

    The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if
    (masked) block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can
    send a crafted unmasked frame with a payload length near UINT64_MAX to trigger an OOB read in a libsoup-
    based client when max_incoming_payload_size is set to 0. (CVE-2026-12478)

    SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority
    (host:port). When the proxy configuration changes (e.g., via system settings or WPAD), cached Proxy-
    Authorization headers from the previous proxy are sent to the new proxy, leaking credentials.
    (CVE-2026-12547)

    A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type
    mismatch between the caller and soup_headers_parse() can cause the length parameter to be incorrectly
    truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to crash an
    application using libsoup or potentially disclose heap memory contents. (CVE-2026-12548)

    The fix for CVE-2026-2443 was regressed by a subsequent rework commit that replaced specific overflow
    checks with a general signed comparison. When a client sends a Range request with a suffix length
    exceeding the content size, the resulting negative start value is not properly clamped, leading to
    malformed HTTP 206 responses and log flooding. (CVE-2026-12549)

    A flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_read_until()
    function causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can
    exploit this by sending a crafted multipart response, potentially causing the client application to crash
    or disclose sensitive heap memory. (CVE-2026-66337)

    A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for
    chunk sizes that silently accepts inputs violating RFC 9112, including leading whitespace, plus sign
    prefixes, and trailing invalid characters. When libsoup operates behind a strict frontend proxy, this
    parsing differential can be exploited to smuggle HTTP requests. (CVE-2026-66338)

    A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup
    incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel
    to the destination server. This allows the destination server to capture proxy credentials, leading to
    information disclosure. (CVE-2026-66339)

    A flaw was found in libsoup's SoupServer HTTP Range header processing. The sort_ranges() comparator in
    soup-message-headers.c truncates a 64-bit subtraction result to 32-bit int, flipping the sign for range
    offsets differing by more than INT_MAX. This causes silent omission of requested byte ranges from HTTP 206
    Partial Content responses on resources larger than approximately 2 GB. (CVE-2026-77014)

    An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the
    CVE-2025-32907 fix.

    CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single
    Range header. Commit 9bb92f7a corrected merge correctness in soup_message_headers_get_ranges_internal() in
    libsoup/soup-message-headers.c, but the coalescing loop still removes merged ranges using
    g_array_remove_index() for each coalesced element. Because GArray is contiguous, each mid-array removal
    performs an O(N) memmove. When many identical satisfiable ranges are supplied (for example bytes=0-0
    repeated thousands of times), the loop performs O(N2) work coalescing them into a single range.

    The vulnerable path is reachable server-side from handle_partial_get() in libsoup/server/http1/soup-
    server-message-io-http1.c when a SoupServer handler returns HTTP 200 with a non-empty body. No
    authentication is required. The number of ranges is bounded only by the maximum request header size (~100
    KiB), allowing roughly 25,000 ranges per request. Reporter measurements on libsoup HEAD containing the
    CVE-2025-32907 fix show ~90 ms single-core CPU per such request at the wire maximum, blocking the server's
    event loop for that duration.

    This is a CPU exhaustion / availability issue only. No memory corruption or information disclosure occurs.

    Affected: libsoup versions containing the CVE-2025-32907 fix but not merge request !550.Fixed upstream: MR
    !550 merged 2026-08-20, replacing per-element removal with O(N) in-place compaction and rejecting Range
    headers requesting more than 200 ranges.Upstream report:
    https://gitlab.gnome.org/GNOME/libsoup/-/issues/538Related: CVE-2025-32907 (CVE-2026-77680)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com//AL2/ALAS2-2026-3970.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/faqs.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-0716.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-12478.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-12547.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-12548.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-12549.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-66337.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-66338.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-66339.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-77014.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-77680.html");
  script_set_attribute(attribute:"solution", value:
"Run 'yum update libsoup' or
  or 'yum update --advisory ALAS2-2026-3970' to update your system.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-66338");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/01/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/12");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:libsoup");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:libsoup-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:libsoup-devel");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux:2");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Amazon Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");

  exit(0);
}

include("rpm2.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var alas_release = get_kb_item("Host/AmazonLinux/release");
if (isnull(alas_release) || !strlen(alas_release)) audit(AUDIT_OS_NOT, "Amazon Linux");
var os_ver = pregmatch(pattern: "^AL(A|\d+|-\d+)", string:alas_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
os_ver = os_ver[1];
if (os_ver != "2")
{
  if (os_ver == 'A') os_ver = 'AMI';
  audit(AUDIT_OS_NOT, "Amazon Linux 2", "Amazon Linux " + os_ver);
}

if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var pkgs = [
    {'reference':'libsoup-2.56.0-6.amzn2.0.9', 'cpu':'aarch64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libsoup-2.56.0-6.amzn2.0.9', 'cpu':'i686', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libsoup-2.56.0-6.amzn2.0.9', 'cpu':'x86_64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libsoup-debuginfo-2.56.0-6.amzn2.0.9', 'cpu':'aarch64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libsoup-debuginfo-2.56.0-6.amzn2.0.9', 'cpu':'i686', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libsoup-debuginfo-2.56.0-6.amzn2.0.9', 'cpu':'x86_64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libsoup-devel-2.56.0-6.amzn2.0.9', 'cpu':'aarch64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libsoup-devel-2.56.0-6.amzn2.0.9', 'cpu':'i686', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libsoup-devel-2.56.0-6.amzn2.0.9', 'cpu':'x86_64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE}
];

var flag = 0;
foreach var package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var sp = NULL;
  var _cpu = NULL;
  var el_string = NULL;
  var rpm_spec_vers_cmp = NULL;
  var epoch = NULL;
  var allowmaj = NULL;
  var exists_check = NULL;
  var cves = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
  if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
  if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
  if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
  if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
  if (!empty_or_null(package_array['cves'])) cves = package_array['cves'];
  if (reference && _release && (!exists_check || rpm_exists(release:_release, rpm:exists_check))) {
    if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libsoup / libsoup-debuginfo / libsoup-devel");
}