Debian dla-4657 : sogo - security update

#%NASL_MIN_LEVEL 80900
#
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Debian Security Advisory dla-4657. The text
# itself is copyright (C) Software in the Public Interest, Inc.
#

include('compat.inc');

if (description)
{
  script_id(323707);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/29");

  script_cve_id(
    "CVE-2025-71276",
    "CVE-2026-8496",
    "CVE-2026-8851",
    "CVE-2026-33550",
    "CVE-2026-46445",
    "CVE-2026-46446"
  );

  script_name(english:"Debian dla-4657 : sogo - security update");

  script_set_attribute(attribute:"synopsis", value:
"The remote Debian host is missing one or more security-related updates.");
  script_set_attribute(attribute:"description", value:
"The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the
dla-4657 advisory.

    - -------------------------------------------------------------------------
    Debian LTS Advisory DLA-4657-1                [email protected]
    https://www.debian.org/lts/security/                           Chris Lamb
    June 29, 2026                                 https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : sogo
    Version        : 5.8.0-2+deb12u3
    CVE IDs        : CVE-2026-46445 CVE-2026-46446 CVE-2025-71276
                     CVE-2026-33550 CVE-2026-8496 CVE-2026-8851
    Debian Bugs    : 1131605 1131606

    Multiple vulnerabilities were discovered in sogo, the open-source
    webmail and groupware server:

    * CVE-2026-46445: A SQL injection vulnerability when PostgreSQL is
      used as the user database.

    * CVE-2026-46446: Address a SQL injection vulnerability when MariaDB
      or PostgreSQL is used as the user database and passwords are
      stored in cleartext.

    * CVE-2025-71276: Fix a A Cross-Site Scripting (XSS) vulnerability in
      events, tasks and contacts categories.

    * CVE-2026-33550: Address a number of Time-Based One-Time Passwords
      (TOTP) vulnerabilities, including if a user disables/enables TOTP,
      various values not being renewed, and an issue around recommended
      TOTP lengths.

    * CVE-2026-8496: Fix an issue where a maliciously crafted .ICS
      calendar invitation file allowed arbitrary JavaScript execution
      within an authenticated webmail session.

    * CVE-2026-8851: Fix an SQL injection vulnerability in the access
      control list management functionality, which could have allowed
      authenticated users to extract arbitrary data from the database by
      injecting SQL subqueries through the uid parameter of the
      addUserInAcls endpoint.

    In addition, a patch was added to fix a Cross-Site Scripting (XSS)
    vulnerability in message subject rendering.

    For Debian 11 bullseye, these problem have been fixed in version
    5.8.0-2+deb12u3.

    We recommend that you upgrade your sogo packages.

    Thank you to Peter Wienemann <[email protected]> for preparing this
    update.

    For the detailed security status of sogo please refer to
    its security tracker page at:
    https://security-tracker.debian.org/tracker/sogo

    Further information about Debian LTS security advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/source-package/sogo");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2025-71276");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-33550");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-46445");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-46446");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-8496");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-8851");
  script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/bullseye/sogo");
  script_set_attribute(attribute:"solution", value:
"Upgrade the sogo packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-71276");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-8851");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/03/22");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/29");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/29");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:sogo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:sogo-common");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:11.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Debian Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}

include('debian_package.inc');

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);

var debian_release = get_kb_item('Host/Debian/release');
if ( isnull(debian_release) ) audit(AUDIT_OS_NOT, 'Debian');
debian_release = chomp(debian_release);
if (! preg(pattern:"^(11)\.[0-9]+", string:debian_release)) audit(AUDIT_OS_NOT, 'Debian 11.0', 'Debian ' + debian_release);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Debian', cpu);

var pkgs = [
    {'release': '11.0', 'prefix': 'sogo', 'reference': '5.8.0-2+deb12u3'},
    {'release': '11.0', 'prefix': 'sogo-common', 'reference': '5.8.0-2+deb12u3'}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var _release = NULL;
  var prefix = NULL;
  var reference = NULL;
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['prefix'])) prefix = package_array['prefix'];
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (_release && prefix && reference) {
    if (deb_check(release:_release, prefix:prefix, reference:reference)) flag++;
  }
}

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : deb_report_get()
  );
  exit(0);
}
else
{
  var tested = deb_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'sogo / sogo-common');
}