Debian dla-4322 : liblog4cxx-dev - security update

#%NASL_MIN_LEVEL 80900
#
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Debian Security Advisory dla-4322. The text
# itself is copyright (C) Software in the Public Interest, Inc.
#

include('compat.inc');

if (description)
{
  script_id(266592);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/10/04");

  script_cve_id("CVE-2025-54812", "CVE-2025-54813");

  script_name(english:"Debian dla-4322 : liblog4cxx-dev - security update");

  script_set_attribute(attribute:"synopsis", value:
"The remote Debian host is missing one or more security-related updates.");
  script_set_attribute(attribute:"description", value:
"The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the
dla-4322 advisory.

    -------------------------------------------------------------------------
    Debian LTS Advisory DLA-4322-1                [email protected]
    https://www.debian.org/lts/security/                       Lukas Mrdian
    October 05, 2025                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : log4cxx
    Version        : 0.11.0-2+deb11u1
    CVE ID         : CVE-2025-54812 CVE-2025-54813
    Debian Bug     : 1111879 1111881

    Multiple vulnerabilities were discovered in log4cxx, a logging library
    for C++ that is compatible with the JAVA log4j framework.

    CVE-2025-54812

        When using HTMLLayout, logger names are not properly escaped when
        writing out to the HTML file. If untrusted data is used to retrieve
        the name of a logger, an attacker could theoretically inject HTML or
        Javascript in order to hide information from logs or steal data from
        the user.

    CVE-2025-54813

        When using JSONLayout, not all payload bytes are properly escaped.
        If an attacker-supplied message contains certain non-printable
        characters, these will be passed along in the message and written out
        as part of the JSON message. This may prevent applications that
        consume these logs from correctly interpreting the information within
        them.

    For Debian 11 bullseye, these problems have been fixed in version
    0.11.0-2+deb11u1.

    We recommend that you upgrade your log4cxx packages.

    For the detailed security status of log4cxx please refer to
    its security tracker page at:
    https://security-tracker.debian.org/tracker/log4cxx

    Further information about Debian LTS security advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://wiki.debian.org/LTS
    Attachment:
    signature.asc
    Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/source-package/log4cxx");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2025-54812");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2025-54813");
  script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/bullseye/log4cxx");
  script_set_attribute(attribute:"solution", value:
"Upgrade the liblog4cxx-dev packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-54813");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/08/22");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/10/05");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/10/04");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:liblog4cxx-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:liblog4cxx-doc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:liblog4cxx11");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:11.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Debian Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}

include('debian_package.inc');

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);

var debian_release = get_kb_item('Host/Debian/release');
if ( isnull(debian_release) ) audit(AUDIT_OS_NOT, 'Debian');
debian_release = chomp(debian_release);
if (! preg(pattern:"^(11)\.[0-9]+", string:debian_release)) audit(AUDIT_OS_NOT, 'Debian 11.0', 'Debian ' + debian_release);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Debian', cpu);

var pkgs = [
    {'release': '11.0', 'prefix': 'liblog4cxx-dev', 'reference': '0.11.0-2+deb11u1'},
    {'release': '11.0', 'prefix': 'liblog4cxx-doc', 'reference': '0.11.0-2+deb11u1'},
    {'release': '11.0', 'prefix': 'liblog4cxx11', 'reference': '0.11.0-2+deb11u1'}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var _release = NULL;
  var prefix = NULL;
  var reference = NULL;
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['prefix'])) prefix = package_array['prefix'];
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (_release && prefix && reference) {
    if (deb_check(release:_release, prefix:prefix, reference:reference)) flag++;
  }
}

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : deb_report_get()
  );
  exit(0);
}
else
{
  var tested = deb_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'liblog4cxx-dev / liblog4cxx-doc / liblog4cxx11');
}