Amazon Linux 2 : perl-DBI (ALAS-2026-4077)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Amazon Linux 2 Security Advisory ALAS-2026-4077.
##

include('compat.inc');

if (description)
{
  script_id(377942);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/11/09");

  script_cve_id(
    "CVE-2026-88815",
    "CVE-2026-88816",
    "CVE-2026-108518",
    "CVE-2026-111879"
  );

  script_name(english:"Amazon Linux 2 : perl-DBI (ALAS-2026-4077)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Amazon Linux 2 host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The version of perl-DBI installed on the remote host is prior to 1.627-4. It is, therefore, affected by multiple
vulnerabilities as referenced in the ALAS2-2026-4077 advisory.

    DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is
    destroyed under a Profile Path with an {attr} element. An {attr} element names a database handle
    attribute, which dbi_profile reads from the handle's inner hash. It expects the inner handle as a
    reference and dereferences it, but a handle that is being destroyed hands back the inner hash itself, so
    the dereference yields the hash's bucket array. A type check on that pointer usually fails and the call
    goes unprofiled. When the memory it addresses passes the check, the attribute lookup dereferences a NULL
    or invalid pointer and the process dies on SIGSEGV. The Path is set by the application, by the Profile
    handle attribute, or by the DBI_PROFILE environment variable, so `DBI_PROFILE={ImplementorClass}` can
    crash an unmodified program. (CVE-2026-108518)

    DBI versions before 1.656 for Perl hang on a later open of a DBD::DBM table because a failed open_data
    does not release the table's lock. open_data creates the table's lock file and takes an exclusive flock on
    it for a CREATE, before the checks that can croak: a dbm_mldbm value that is not a module name, a failing
    tie, or a missing data file. The croak unwinds before the table object is blessed, so nothing releases the
    lock, and the meta data holding the open descriptor stays cached on the database handle. The dbm_mldbm and
    dbm_type values come from the DSN or the connect attributes, so a caller that chooses the serializer or
    the storage backend can trigger the failure. The flock has no timeout, so a later open of that table (even
    through a separate database handle) blocks for as long as the handle holding the stale lock lives, in the
    same process or any other. (CVE-2026-111879)

    Fix DBI::sql_type_cast on IV/NV

    NOTE: Fixed by: https://github.com/perl5-dbi/dbi/commit/e5ad87e5602da995d28b4d65df222368b58d6702
    (CVE-2026-88815)

    Fix FetchHashKeyName   on IV/NV

    NOTE: Fixed by: https://github.com/perl5-dbi/dbi/commit/70962570212dc60a5428098cf2a0462ad5945851
    (CVE-2026-88816)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com//AL2/ALAS2-2026-4077.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/faqs.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-108518.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-111879.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-88815.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-88816.html");
  script_set_attribute(attribute:"solution", value:
"Run 'yum update perl-DBI' or
  or 'yum update --advisory ALAS2-2026-4077' to update your system.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-111879");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/28");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/11/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/11/09");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:perl-DBI");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:perl-DBI-debuginfo");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux:2");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Amazon Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");

  exit(0);
}

include("rpm2.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var alas_release = get_kb_item("Host/AmazonLinux/release");
if (isnull(alas_release) || !strlen(alas_release)) audit(AUDIT_OS_NOT, "Amazon Linux");
var os_ver = pregmatch(pattern: "^AL(A|\d+|-\d+)", string:alas_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
os_ver = os_ver[1];
if (os_ver != "2")
{
  if (os_ver == 'A') os_ver = 'AMI';
  audit(AUDIT_OS_NOT, "Amazon Linux 2", "Amazon Linux " + os_ver);
}

if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var pkgs = [
    {'reference':'perl-DBI-1.627-4.amzn2.0.9', 'cpu':'aarch64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'perl-DBI-1.627-4.amzn2.0.9', 'cpu':'i686', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'perl-DBI-1.627-4.amzn2.0.9', 'cpu':'x86_64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'perl-DBI-debuginfo-1.627-4.amzn2.0.9', 'cpu':'aarch64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'perl-DBI-debuginfo-1.627-4.amzn2.0.9', 'cpu':'i686', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'perl-DBI-debuginfo-1.627-4.amzn2.0.9', 'cpu':'x86_64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE}
];

var flag = 0;
foreach var package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var sp = NULL;
  var _cpu = NULL;
  var el_string = NULL;
  var rpm_spec_vers_cmp = NULL;
  var epoch = NULL;
  var allowmaj = NULL;
  var exists_check = NULL;
  var cves = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
  if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
  if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
  if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
  if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
  if (!empty_or_null(package_array['cves'])) cves = package_array['cves'];
  if (reference && _release && (!exists_check || rpm_exists(release:_release, rpm:exists_check))) {
    if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "perl-DBI / perl-DBI-debuginfo");
}