Debian dla-4667 : libnginx-mod-http-geoip - security update

#%NASL_MIN_LEVEL 80900
#
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Debian Security Advisory dla-4667. The text
# itself is copyright (C) Software in the Public Interest, Inc.
#

include('compat.inc');

if (description)
{
  script_id(325053);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/03");

  script_cve_id("CVE-2026-42055", "CVE-2026-48142");
  script_xref(name:"IAVA", value:"2026-A-0601");

  script_name(english:"Debian dla-4667 : libnginx-mod-http-geoip - security update");

  script_set_attribute(attribute:"synopsis", value:
"The remote Debian host is missing one or more security-related updates.");
  script_set_attribute(attribute:"description", value:
"The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the
dla-4667 advisory.

    -------------------------------------------------------------------------
    Debian LTS Advisory DLA-4667-1                [email protected]
    https://www.debian.org/lts/security/          Carlos Henrique Lima Melara
    July 03, 2026                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : nginx
    Version        : 1.22.1-9+deb12u9
    CVE ID         : CVE-2026-42055 CVE-2026-48142
    Debian Bug     : 1140359 1140361

    Multiple vulnerabilities were discoverd in Nginx, a high-performance web
    and reverse proxy server, which could result in remote code execution,
    denial of service or memory disclosure.

    CVE-2026-42055

        NGINX Open Source has a vulnerability in the ngx_http_proxy_v2_module and
        ngx_http_grpc_module modules. This vulnerability exists when the
        proxy_http_version to 2 or grpc_pass directives are used to proxy HTTP/2
        traffic, the ignore_invalid_headers directive is set to off, and the
        large_client_header_buffers directive size is larger than 2 megabytes. A
        remote, unauthenticated attacker, along with conditions beyond their
        control, could send large headers while creating an upstream request. This
        may cause a heap-based buffer overflow in the NGINX worker process leading
        to a restart. Additionally, attackers can execute code on systems with
        Address Space Layout Randomization (ASLR) disabled or when the attacker can
        bypass ASLR.

    CVE-2026-48142

       NGINX Open Source has a vulnerability in the ngx_http_charset_module module.
       When content is served or proxied through a location block with both
       source_charset utf-8; and a charset directive (for example, charset koi8-r;)
       configured, remote, unauthenticated attackers can send requests (in
       conjunction with conditions beyond their control) to cause a heap buffer
       over-read in the NGINX worker process, leading to limited disclosure of
       memory or a restart.

    For Debian 12 bookworm, these problems have been fixed in version
    1.22.1-9+deb12u9.

    We recommend that you upgrade your nginx packages.

    For the detailed security status of nginx please refer to
    its security tracker page at:
    https://security-tracker.debian.org/tracker/nginx

    Further information about Debian LTS security advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://wiki.debian.org/LTS
    Attachment:
    signature.asc
    Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/source-package/nginx");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-42055");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-48142");
  script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/bookworm/nginx");
  script_set_attribute(attribute:"solution", value:
"Upgrade the libnginx-mod-http-geoip packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-42055");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/17");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/03");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/03");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libnginx-mod-http-geoip");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libnginx-mod-http-image-filter");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libnginx-mod-http-perl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libnginx-mod-http-xslt-filter");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libnginx-mod-mail");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libnginx-mod-stream");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libnginx-mod-stream-geoip");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:nginx");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:nginx-common");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:nginx-core");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:nginx-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:nginx-doc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:nginx-extras");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:nginx-full");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:nginx-light");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:12.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Debian Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}

include('debian_package.inc');

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);

var debian_release = get_kb_item('Host/Debian/release');
if ( isnull(debian_release) ) audit(AUDIT_OS_NOT, 'Debian');
debian_release = chomp(debian_release);
if (! preg(pattern:"^(12)\.[0-9]+", string:debian_release)) audit(AUDIT_OS_NOT, 'Debian 12.0', 'Debian ' + debian_release);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Debian', cpu);

var pkgs = [
    {'release': '12.0', 'prefix': 'libnginx-mod-http-geoip', 'reference': '1.22.1-9+deb12u9'},
    {'release': '12.0', 'prefix': 'libnginx-mod-http-image-filter', 'reference': '1.22.1-9+deb12u9'},
    {'release': '12.0', 'prefix': 'libnginx-mod-http-perl', 'reference': '1.22.1-9+deb12u9'},
    {'release': '12.0', 'prefix': 'libnginx-mod-http-xslt-filter', 'reference': '1.22.1-9+deb12u9'},
    {'release': '12.0', 'prefix': 'libnginx-mod-mail', 'reference': '1.22.1-9+deb12u9'},
    {'release': '12.0', 'prefix': 'libnginx-mod-stream', 'reference': '1.22.1-9+deb12u9'},
    {'release': '12.0', 'prefix': 'libnginx-mod-stream-geoip', 'reference': '1.22.1-9+deb12u9'},
    {'release': '12.0', 'prefix': 'nginx', 'reference': '1.22.1-9+deb12u9'},
    {'release': '12.0', 'prefix': 'nginx-common', 'reference': '1.22.1-9+deb12u9'},
    {'release': '12.0', 'prefix': 'nginx-core', 'reference': '1.22.1-9+deb12u9'},
    {'release': '12.0', 'prefix': 'nginx-dev', 'reference': '1.22.1-9+deb12u9'},
    {'release': '12.0', 'prefix': 'nginx-doc', 'reference': '1.22.1-9+deb12u9'},
    {'release': '12.0', 'prefix': 'nginx-extras', 'reference': '1.22.1-9+deb12u9'},
    {'release': '12.0', 'prefix': 'nginx-full', 'reference': '1.22.1-9+deb12u9'},
    {'release': '12.0', 'prefix': 'nginx-light', 'reference': '1.22.1-9+deb12u9'}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var _release = NULL;
  var prefix = NULL;
  var reference = NULL;
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['prefix'])) prefix = package_array['prefix'];
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (_release && prefix && reference) {
    if (deb_check(release:_release, prefix:prefix, reference:reference)) flag++;
  }
}

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : deb_report_get()
  );
  exit(0);
}
else
{
  var tested = deb_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'libnginx-mod-http-geoip / libnginx-mod-http-image-filter / etc');
}