Amazon Linux 2 : libsoup (ALAS-2026-3998)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Amazon Linux 2 Security Advisory ALAS-2026-3998.
##

include('compat.inc');

if (description)
{
  script_id(365177);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/12");

  script_cve_id(
    "CVE-2026-15714",
    "CVE-2026-102557",
    "CVE-2026-102558",
    "CVE-2026-102559",
    "CVE-2026-103399"
  );
  script_xref(name:"IAVA", value:"2026-A-0894");

  script_name(english:"Amazon Linux 2 : libsoup (ALAS-2026-3998)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Amazon Linux 2 host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The version of libsoup installed on the remote host is prior to 2.56.0-6. It is, therefore, affected by multiple
vulnerabilities as referenced in the ALAS2-2026-3998 advisory.

    A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup
    did not adequately cap total message size against the limits of the underlying buffer type. A remote peer
    could send fragments that caused size truncation while the implementation still used the full length,
    leading to heap corruption or a crash. (CVE-2026-102557)

    A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection
    could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped,
    causing a heap buffer overflow while reading frame data. (CVE-2026-102558)

    A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing
    payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine
    still used the full length, causing a heap buffer overflow. (CVE-2026-102559)

    A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Expect:
    100-continue and a request body, and SoupServer returns an early final (non-1xx) response before the body
    is read, the server neither drains the declared body bytes nor closes the connection. On a keep-alive
    connection, those leftover bytes are interpreted as a subsequent HTTP request. A remote, unauthenticated
    attacker can place a complete HTTP request in the body and cause SoupServer to process that smuggled
    request, leading to unintended request handling. (CVE-2026-103399)

    An out-of-bounds read vulnerability was found in libsoup's multipart processing subsystem. The flaw exists
    in the soup_multipart_input_stream_read_headers() function inside soup-multipart-input-stream.c, which
    does not adequately restrict or validate the size of incoming multipart boundary strings. When processing
    a crafted HTTP response containing a malformed or oversized boundary parameter, the internal stream reader
    reads past the allocated buffer bounds. A remote, unauthenticated attacker can exploit this behavior to
    cause a service denial (DoS) through application failure or potentially read fragments of unauthorized
    memory metadata. (CVE-2026-15714)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com//AL2/ALAS2-2026-3998.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/faqs.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-102557.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-102558.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-102559.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-103399.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-15714.html");
  script_set_attribute(attribute:"solution", value:
"Run 'yum update libsoup' or
  or 'yum update --advisory ALAS2-2026-3998' to update your system.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-102559");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/12");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:libsoup");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:libsoup-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:libsoup-devel");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux:2");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Amazon Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");

  exit(0);
}

include("rpm2.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var alas_release = get_kb_item("Host/AmazonLinux/release");
if (isnull(alas_release) || !strlen(alas_release)) audit(AUDIT_OS_NOT, "Amazon Linux");
var os_ver = pregmatch(pattern: "^AL(A|\d+|-\d+)", string:alas_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
os_ver = os_ver[1];
if (os_ver != "2")
{
  if (os_ver == 'A') os_ver = 'AMI';
  audit(AUDIT_OS_NOT, "Amazon Linux 2", "Amazon Linux " + os_ver);
}

if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var pkgs = [
    {'reference':'libsoup-2.56.0-6.amzn2.0.10', 'cpu':'aarch64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libsoup-2.56.0-6.amzn2.0.10', 'cpu':'i686', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libsoup-2.56.0-6.amzn2.0.10', 'cpu':'x86_64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libsoup-debuginfo-2.56.0-6.amzn2.0.10', 'cpu':'aarch64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libsoup-debuginfo-2.56.0-6.amzn2.0.10', 'cpu':'i686', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libsoup-debuginfo-2.56.0-6.amzn2.0.10', 'cpu':'x86_64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libsoup-devel-2.56.0-6.amzn2.0.10', 'cpu':'aarch64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libsoup-devel-2.56.0-6.amzn2.0.10', 'cpu':'i686', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libsoup-devel-2.56.0-6.amzn2.0.10', 'cpu':'x86_64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE}
];

var flag = 0;
foreach var package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var sp = NULL;
  var _cpu = NULL;
  var el_string = NULL;
  var rpm_spec_vers_cmp = NULL;
  var epoch = NULL;
  var allowmaj = NULL;
  var exists_check = NULL;
  var cves = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
  if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
  if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
  if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
  if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
  if (!empty_or_null(package_array['cves'])) cves = package_array['cves'];
  if (reference && _release && (!exists_check || rpm_exists(release:_release, rpm:exists_check))) {
    if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libsoup / libsoup-debuginfo / libsoup-devel");
}