Debian dla-4786 : libevent-2.1-7 - security update

#%NASL_MIN_LEVEL 80900
#
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Debian Security Advisory dla-4786. The text
# itself is copyright (C) Software in the Public Interest, Inc.
#

include('compat.inc');

if (description)
{
  script_id(348186);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/18");

  script_cve_id(
    "CVE-2026-63379",
    "CVE-2026-63381",
    "CVE-2026-63382",
    "CVE-2026-63383",
    "CVE-2026-63384",
    "CVE-2026-63385",
    "CVE-2026-63387",
    "CVE-2026-63388"
  );

  script_name(english:"Debian dla-4786 : libevent-2.1-7 - security update");

  script_set_attribute(attribute:"synopsis", value:
"The remote Debian host is missing one or more security-related updates.");
  script_set_attribute(attribute:"description", value:
"The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the
dla-4786 advisory.

    -------------------------------------------------------------------------
    Debian LTS Advisory DLA-4786-1                [email protected]
    https://www.debian.org/lts/security/                  Andreans Henriksson
    September 18, 2026                            https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : libevent
    Version        : 2.1.12-stable-8+deb12u1
    CVE ID         : CVE-2026-63379 CVE-2026-63381 CVE-2026-63382 CVE-2026-63383
                     CVE-2026-63384 CVE-2026-63385 CVE-2026-63387 CVE-2026-63388
    Debian Bug     :

    Multiple vulnerabilities has been found in libevent, an event notification
    library.

    CVE-2026-63379 (GHSA-2gmv-p5m7-98p6)

        Sebastianosrt discovered that libevent's HTTP implementation did not
        properly handle HTTP trailers. This could allow trailer headers to be
        interpreted as regular request headers, potentially resulting in HTTP
        header smuggling and request interpretation differences.

    CVE-2026-63381 (GHSA-c2pj-cg4r-88c8)

        DarkaMaul discovered a dangling pointer in
        evbuffer_add_buffer_reference(). When the output buffer contained an empty
        chain, the chain could be freed without updating the corresponding buffer
        pointers before it was subsequently reused. This could result in memory
        corruption or a denial of service.

    CVE-2026-63382 (GHSA-q39v-w2g7-gr8j)

        Xclow3n discovered that libevent's HTTP parser incorrectly handled
        Transfer-Encoding headers and chunked request framing. The issue could
        cause libevent and an HTTP proxy to disagree about request boundaries,
        allowing HTTP request smuggling.

    CVE-2026-63383 (GHSA-fj29-64w6-73h6)

        Brubbish discovered an out-of-bounds read in the tagged RPC parsing code.
        Processing a malformed RPC tag could cause libevent to read beyond the
        available buffer, potentially resulting in a denial of service.

    CVE-2026-63384 (GHSA-45c6-qx49-89m8)

        Brubbish discovered an integer overflow in evtag_unmarshal_header().
        An attacker able to supply a specially crafted tagged RPC message could
        cause an incorrect length calculation, potentially resulting in memory
        allocation or parsing errors and a denial of service.

    CVE-2026-63385 (GHSA-jcwh-pvf2-73p2)

        AsafMeizner discovered HTTP parsing issues involving percent-encoded NUL
        bytes and obsolete folded headers. These parsing differences could allow a
        frontend HTTP proxy and a libevent-based backend to interpret a request
        differently, potentially resulting in access control bypass or header
        injection.

    CVE-2026-63387 (GHSA-58rx-7448-jw47)

        Sectroyer discovered an off-by-one stack buffer overflow in the DNS server
        code. A specially crafted DNS response could trigger an out-of-bounds
        write when constructing a DNS response of a particular size, potentially
        resulting in a denial of service or memory corruption.

    CVE-2026-63388 (GHSA-cvq5-vrvr-j338)

        Mat-mo discovered a heap-based out-of-bounds write in the socket handling
        code. When accepting an AF_UNIX connection, an attacker-controlled peer
        address could be copied into a buffer that was too small when assertions
        were disabled. This could result in memory corruption and potentially
        arbitrary code execution.


    For Debian 12 bookworm, these problems have been fixed in version
    2.1.12-stable-8+deb12u1.

    We recommend that you upgrade your libevent packages.

    For the detailed security status of libevent please refer to
    its security tracker page at:
    https://security-tracker.debian.org/tracker/libevent

    Further information about Debian LTS security advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://wiki.debian.org/LTS
    Attachment:
    signature.asc
    Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/source-package/libevent");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-63379");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-63381");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-63382");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-63383");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-63384");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-63385");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-63387");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-63388");
  script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/bookworm/libevent");
  script_set_attribute(attribute:"solution", value:
"Upgrade the libevent-2.1-7 packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-63387");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-63388");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-63385");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/18");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/18");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libevent-2.1-7");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libevent-core-2.1-7");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libevent-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libevent-extra-2.1-7");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libevent-openssl-2.1-7");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libevent-pthreads-2.1-7");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:12.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Debian Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}

include('debian_package.inc');

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);

var debian_release = get_kb_item('Host/Debian/release');
if ( isnull(debian_release) ) audit(AUDIT_OS_NOT, 'Debian');
debian_release = chomp(debian_release);
if (! preg(pattern:"^(12)\.[0-9]+", string:debian_release)) audit(AUDIT_OS_NOT, 'Debian 12.0', 'Debian ' + debian_release);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Debian', cpu);

var pkgs = [
    {'release': '12.0', 'prefix': 'libevent-2.1-7', 'reference': '2.1.12-stable-8+deb12u1'},
    {'release': '12.0', 'prefix': 'libevent-core-2.1-7', 'reference': '2.1.12-stable-8+deb12u1'},
    {'release': '12.0', 'prefix': 'libevent-dev', 'reference': '2.1.12-stable-8+deb12u1'},
    {'release': '12.0', 'prefix': 'libevent-extra-2.1-7', 'reference': '2.1.12-stable-8+deb12u1'},
    {'release': '12.0', 'prefix': 'libevent-openssl-2.1-7', 'reference': '2.1.12-stable-8+deb12u1'},
    {'release': '12.0', 'prefix': 'libevent-pthreads-2.1-7', 'reference': '2.1.12-stable-8+deb12u1'}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var _release = NULL;
  var prefix = NULL;
  var reference = NULL;
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['prefix'])) prefix = package_array['prefix'];
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (_release && prefix && reference) {
    if (deb_check(release:_release, prefix:prefix, reference:reference)) flag++;
  }
}

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : deb_report_get()
  );
  exit(0);
}
else
{
  var tested = deb_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'libevent-2.1-7 / libevent-core-2.1-7 / libevent-dev / etc');
}