Debian dla-4840 : jq - security update

#%NASL_MIN_LEVEL 80900
#
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Debian Security Advisory dla-4840. The text
# itself is copyright (C) Software in the Public Interest, Inc.
#

include('compat.inc');

if (description)
{
  script_id(366688);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/16");

  script_cve_id("CVE-2026-32316");
  script_xref(name:"IAVB", value:"2025-B-0188");

  script_name(english:"Debian dla-4840 : jq - security update");

  script_set_attribute(attribute:"synopsis", value:
"The remote Debian host is missing a security-related update.");
  script_set_attribute(attribute:"description", value:
"The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dla-4840
advisory.

    - -------------------------------------------------------------------------
    Debian LTS Advisory DLA-4840-1                [email protected]
    https://www.debian.org/lts/security/                        Simon Quigley
    October 16, 2026                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : jq
    Version        : 1.6-2.1+deb12u3
    CVE ID         : CVE-2026-32316

    The fix for CVE-2026-32316 in 1.6-2.1+deb12u2 stopped one string from
    growing past its limit, but repeating a string with * could still keep
    appending. A repeat that cannot fit now fails with Repeat string
    result too long. Upstream fixed this in 1.8 by adding
    jv_string_repeat(), which would be a new symbol in libjq1, so this update
    checks the length in the multiply function that is already there. A
    count below 1 still returns the same result as before.

    This update also fixes two memory errors that have no CVE id.
    args2obj() freed a name and its value twice when jq_compile_args() was
    given an array (GHSA-gf4g-95wj-4q4r). The jq command line always passes
    an object, so this only affects programs that link libjq and pass an
    array. f_multiply() reused the string it was repeating, so
    (a*200)*30 copied from memory that had already been freed. That is
    upstream commit 9163e096.

    A very deep delpaths still aborts in jv_array_length(), which is the
    crash reported after DLA-4662-1. A fix for that is being sent upstream
    before it is applied here.

    For Debian 12 bookworm, this problem has been fixed in version
    1.6-2.1+deb12u3.

    We recommend that you upgrade your jq packages.

    For the detailed security status of jq please refer to
    its security tracker page at:
    https://security-tracker.debian.org/tracker/jq

    Further information about Debian LTS security advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/source-package/jq");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-32316");
  script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/bookworm/jq");
  script_set_attribute(attribute:"solution", value:
"Upgrade the jq packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-32316");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/11/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/16");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:jq");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libjq-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libjq1");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:12.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Debian Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}

include('debian_package.inc');

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);

var debian_release = get_kb_item('Host/Debian/release');
if ( isnull(debian_release) ) audit(AUDIT_OS_NOT, 'Debian');
debian_release = chomp(debian_release);
if (! preg(pattern:"^(12)\.[0-9]+", string:debian_release)) audit(AUDIT_OS_NOT, 'Debian 12.0', 'Debian ' + debian_release);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Debian', cpu);

var pkgs = [
    {'release': '12.0', 'prefix': 'jq', 'reference': '1.6-2.1+deb12u3'},
    {'release': '12.0', 'prefix': 'libjq-dev', 'reference': '1.6-2.1+deb12u3'},
    {'release': '12.0', 'prefix': 'libjq1', 'reference': '1.6-2.1+deb12u3'}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var _release = NULL;
  var prefix = NULL;
  var reference = NULL;
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['prefix'])) prefix = package_array['prefix'];
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (_release && prefix && reference) {
    if (deb_check(release:_release, prefix:prefix, reference:reference)) flag++;
  }
}

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : deb_report_get()
  );
  exit(0);
}
else
{
  var tested = deb_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'jq / libjq-dev / libjq1');
}