Debian dla-4708 : python-authlib-doc - security update

#%NASL_MIN_LEVEL 80900
#
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Debian Security Advisory dla-4708. The text
# itself is copyright (C) Software in the Public Interest, Inc.
#

include('compat.inc');

if (description)
{
  script_id(331518);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/31");

  script_cve_id(
    "CVE-2026-27962",
    "CVE-2026-28490",
    "CVE-2026-28498",
    "CVE-2026-41425",
    "CVE-2026-44681"
  );

  script_name(english:"Debian dla-4708 : python-authlib-doc - security update");

  script_set_attribute(attribute:"synopsis", value:
"The remote Debian host is missing one or more security-related updates.");
  script_set_attribute(attribute:"description", value:
"The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the
dla-4708 advisory.

    - -------------------------------------------------------------------------
    Debian LTS Advisory DLA-4708-1                [email protected]
    https://www.debian.org/lts/security/                       Andrej Shadura
    July 31, 2026                                 https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : python-authlib
    Version        : 0.15.4-1+deb11u4 1.2.0-1+deb12u2
    CVE ID         : CVE-2026-27962 CVE-2026-28490 CVE-2026-28498 CVE-2026-41425
                     CVE-2026-44681

    The following security issue has been identified (and fixed) in python-authlib
    as shipped in Debian bullseye and Debian bookworm.

    CVE-2026-44681

        An unauthenticated open redirect in Authlib's OpenIDImplicitGrant
        and OpenIDHybridGrant authorisation endpoint allowed a remote
        attacker to cause the authorisation server to issue an HTTP 302 to
        an attacker-chosen URL by submitting an authorisation request that
        omits the openid scope.

    For Debian 11 bullseye, this problem has been fixed in version
    0.15.4-1+deb11u4.

    In addition, the following issues have been fixed in the python-authlib version
    as shipped in Debian bookworm:

    CVE-2026-27962

        Fix authentication and authorization bypass vulnerability by embedding a
        crafted public key in the jwk header field when key=None is passed to JWS
        deserialisation functions.

    CVE-2026-28490

        Authlib exposed distinguishable error responses between invalid PKCS#1 v1.5
        padding and invalid AES-GCM tag, enabling Bleichenbacher-style attacks.

    CVE-2026-28498

        Fix OIDC ID Token validation bypass in at_hash and c_hash verification.
        _verify_hash() silently returned True when create_half_hash() received an
        unknown algorithm, allowing forged ID Tokens to pass validation.

    CVE-2026-41425

        CSRF protection now covers the cache feature in
        authlib.integrations.starlette_client.OAuth as well.

    For Debian 12 bookworm, these problems have been fixed in version
    1.2.0-1+deb12u2.

    We recommend that you upgrade your python-authlib packages.

    For the detailed security status of python-authlib please refer to
    its security tracker page at:
    https://security-tracker.debian.org/tracker/python-authlib

    Further information about Debian LTS security advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://security-tracker.debian.org/tracker/source-package/python-authlib
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1ee877aa");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-27962");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-28490");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-28498");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-41425");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-44681");
  script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/bookworm/python-authlib");
  script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/bullseye/python-authlib");
  script_set_attribute(attribute:"solution", value:
"Upgrade the python-authlib-doc packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-28498");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-28490");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/03/16");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/31");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/31");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:python-authlib-doc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:python3-authlib");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:11.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:12.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Debian Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}

include('debian_package.inc');

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);

var debian_release = get_kb_item('Host/Debian/release');
if ( isnull(debian_release) ) audit(AUDIT_OS_NOT, 'Debian');
debian_release = chomp(debian_release);
if (! preg(pattern:"^(11)\.[0-9]+|^(12)\.[0-9]+", string:debian_release)) audit(AUDIT_OS_NOT, 'Debian 11.0 / 12.0', 'Debian ' + debian_release);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Debian', cpu);

var pkgs = [
    {'release': '11.0', 'prefix': 'python-authlib-doc', 'reference': '0.15.4-1+deb11u4'},
    {'release': '11.0', 'prefix': 'python3-authlib', 'reference': '0.15.4-1+deb11u4'},
    {'release': '12.0', 'prefix': 'python-authlib-doc', 'reference': '1.2.0-1+deb12u2'},
    {'release': '12.0', 'prefix': 'python3-authlib', 'reference': '1.2.0-1+deb12u2'}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var _release = NULL;
  var prefix = NULL;
  var reference = NULL;
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['prefix'])) prefix = package_array['prefix'];
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (_release && prefix && reference) {
    if (deb_check(release:_release, prefix:prefix, reference:reference)) flag++;
  }
}

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : deb_report_get()
  );
  exit(0);
}
else
{
  var tested = deb_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'python-authlib-doc / python3-authlib');
}