Debian dla-4490 : libcrypto1.1-udeb - security update

#%NASL_MIN_LEVEL 80900
#
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Debian Security Advisory dla-4490. The text
# itself is copyright (C) Software in the Public Interest, Inc.
#

include('compat.inc');

if (description)
{
  script_id(299860);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/30");

  script_cve_id(
    "CVE-2025-68160",
    "CVE-2025-69418",
    "CVE-2025-69419",
    "CVE-2025-69420",
    "CVE-2025-69421",
    "CVE-2026-22795",
    "CVE-2026-22796"
  );
  script_xref(name:"IAVA", value:"2026-A-0087-S");

  script_name(english:"Debian dla-4490 : libcrypto1.1-udeb - security update");

  script_set_attribute(attribute:"synopsis", value:
"The remote Debian host is missing one or more security-related updates.");
  script_set_attribute(attribute:"description", value:
"The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the
dla-4490 advisory.

    -------------------------------------------------------------------------
    Debian LTS Advisory DLA-4490-1                [email protected]
    https://www.debian.org/lts/security/                   Andreas Henriksson
    February 23, 2026                             https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : openssl
    Version        : 1.1.1w-0+deb11u5
    CVE ID         : CVE-2025-68160 CVE-2025-69418 CVE-2025-69419 CVE-2025-69420
                     CVE-2025-69421 CVE-2026-22795 CVE-2026-22796
    Debian Bug     :

    Aisle Research found multiple vulnerabilites in OpenSSL, a Secure Socket Layer
    toolkit providing the SSL and TLS cryptographic protocols for secure
    communication over the Internet.

    CVE-2025-68160

        Petr Simecek (Aisle Research) and Stanislav Fort (Aisle Research) found
        writing large, newline-free data into a BIO chain using the line-buffering
        filter where the next BIO performs short writes can trigger a heap-based
        out-of-bounds write. This out-of-bounds write can cause memory corruption
        which typically results in a crash, leading to Denial of Service for an
        application.

    CVE-2025-69418

        Stanislav Fort (Aisle Research) found using the low-level OCB API directly
        with AES-NI or other hardware-accelerated code paths, inputs whose length
        is not a multiple of 16 bytes can leave the final partial block unencrypted
        and unauthenticated. The trailing 1-15 bytes of a message may be exposed in
        cleartext on encryption and are not covered by the authentication tag,
        allowing an attacker to read or tamper with those bytes without detection.

    CVE-2025-69419

        Stanislav Fort (Aisle Research) found a maliciously crafted PKCS#12 file
        with a BMPString (UTF-16BE) can lead to out-of-bounds write causing a
        memory corruption which can have various consequences including a Denial of
        Service.

    CVE-2025-69420

        Luigino Camastra (Aisle Research) found a type confusion vulnerability
        exists in the TimeStamp Response verification code, leading to an invalid
        or NULL pointer dereference when processing a malformed TimeStamp Response
        file. The result is a possible Denial of Service.

    CVE-2025-69421

        Luigino Camastra (Aisle Research) found out processing a malformed PKCS#12
        file can trigger a NULL pointer dereference in the
        PKCS12_item_decrypt_d2i_ex() function that can trigger a crash which leads
        to Denial of Service for an application processing PKCS#12 files.

    CVE-2026-22795

        Luigino Camastra (Aisle Research) found that an application processing a
        malformed PKCS#12 file can be caused to dereference an invalid or NULL
        pointer on memory read, resulting in a Denial of Service.

    CVE-2026-22796

        Luigino Camastra (Aisle Research) found that an application performing
        signature verification of PKCS#7 data or calling directly the
        PKCS7_digest_from_attributes() function can be caused to dereference an
        invalid or NULL pointer when reading, resulting in a Denial of Service.

    More details are available in:
    https://openssl-library.org/news/secadv/20260127.txt

    For Debian 11 bullseye, these problems have been fixed in version
    1.1.1w-0+deb11u5.

    We recommend that you upgrade your openssl packages.

    For the detailed security status of openssl please refer to
    its security tracker page at:
    https://security-tracker.debian.org/tracker/openssl

    Further information about Debian LTS security advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://wiki.debian.org/LTS
    Attachment:
    signature.asc
    Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/source-package/openssl");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2025-68160");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2025-69418");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2025-69419");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2025-69420");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2025-69421");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-22795");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-22796");
  script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/bullseye/openssl");
  script_set_attribute(attribute:"solution", value:
"Upgrade the libcrypto1.1-udeb packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-69421");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/04/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/02/23");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/02/24");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libcrypto1.1-udeb");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libssl-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libssl-doc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libssl1.1");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libssl1.1-udeb");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:openssl");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:11.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Debian Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}

include('debian_package.inc');

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);

var debian_release = get_kb_item('Host/Debian/release');
if ( isnull(debian_release) ) audit(AUDIT_OS_NOT, 'Debian');
debian_release = chomp(debian_release);
if (! preg(pattern:"^(11)\.[0-9]+", string:debian_release)) audit(AUDIT_OS_NOT, 'Debian 11.0', 'Debian ' + debian_release);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Debian', cpu);

var pkgs = [
    {'release': '11.0', 'prefix': 'libcrypto1.1-udeb', 'reference': '1.1.1w-0+deb11u5'},
    {'release': '11.0', 'prefix': 'libssl-dev', 'reference': '1.1.1w-0+deb11u5'},
    {'release': '11.0', 'prefix': 'libssl-doc', 'reference': '1.1.1w-0+deb11u5'},
    {'release': '11.0', 'prefix': 'libssl1.1', 'reference': '1.1.1w-0+deb11u5'},
    {'release': '11.0', 'prefix': 'libssl1.1-udeb', 'reference': '1.1.1w-0+deb11u5'},
    {'release': '11.0', 'prefix': 'openssl', 'reference': '1.1.1w-0+deb11u5'}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var _release = NULL;
  var prefix = NULL;
  var reference = NULL;
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['prefix'])) prefix = package_array['prefix'];
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (_release && prefix && reference) {
    if (deb_check(release:_release, prefix:prefix, reference:reference)) flag++;
  }
}

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : deb_report_get()
  );
  exit(0);
}
else
{
  var tested = deb_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'libcrypto1.1-udeb / libssl-dev / libssl-doc / libssl1.1 / etc');
}