Debian dla-4844 : libssh-4 - security update

#%NASL_MIN_LEVEL 80900
#
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Debian Security Advisory dla-4844. The text
# itself is copyright (C) Software in the Public Interest, Inc.
#

include('compat.inc');

if (description)
{
  script_id(372635);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/28");

  script_cve_id(
    "CVE-2019-6111",
    "CVE-2026-0964",
    "CVE-2026-0965",
    "CVE-2026-0966",
    "CVE-2026-0967",
    "CVE-2026-0968",
    "CVE-2026-3731",
    "CVE-2026-59843",
    "CVE-2026-59844",
    "CVE-2026-59845",
    "CVE-2026-59846",
    "CVE-2026-59847",
    "CVE-2026-59848",
    "CVE-2026-59850"
  );

  script_name(english:"Debian dla-4844 : libssh-4 - security update");

  script_set_attribute(attribute:"synopsis", value:
"The remote Debian host is missing one or more security-related updates.");
  script_set_attribute(attribute:"description", value:
"The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the
dla-4844 advisory.

    - -------------------------------------------------------------------------
    Debian LTS Advisory DLA-4844-1                [email protected]
    https://www.debian.org/lts/security/                        Simon Quigley
    October 20, 2026                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : libssh
    Version        : 0.10.6-0+deb12u3
    CVE ID         : CVE-2026-0964 CVE-2026-0965 CVE-2026-0966 CVE-2026-0967
                     CVE-2026-0968 CVE-2026-3731 CVE-2026-59843 CVE-2026-59844
                     CVE-2026-59845 CVE-2026-59846 CVE-2026-59847 CVE-2026-59848
                     CVE-2026-59850

    Several vulnerabilities were discovered in libssh, a tiny C SSH library.

    CVE-2026-0964

        A malicious SCP server can send a path that escapes the working
        directory. This is the same issue as OpenSSH CVE-2019-6111.

    CVE-2026-0965

        Parsing a configuration file that is not a regular file, or that is
        too large, could be used for a denial of service.

    CVE-2026-0966

        ssh_get_hexa() could underflow a heap buffer on invalid input.

    CVE-2026-0967

        A crafted pattern in a configuration or known_hosts file could make
        match_pattern() backtrack until it times out.

    CVE-2026-0968

        A malicious SFTP server can send a longname that
        sftp_parse_longname() reads past.

    CVE-2026-3731

        sftp_extensions_get_name() and sftp_extensions_get_data() did not
        reject an index past the end of the extension list.

    CVE-2026-59843

        A peer that advertises a maximum channel packet size of 0 can cause
        a denial of service.

    CVE-2026-59844

        An oversized length in an SSH_FXP_READ request can cause a denial of
        service.

    CVE-2026-59845

        ProxyCommand did not check the return value of fork(), which can
        cause a denial of service.

    CVE-2026-59846

        A username containing shell metacharacters could be expanded into
        ProxyCommand via %r.

    CVE-2026-59847

        With the OpenSSL backend, a failed AES-GCM tag check could be
        treated as success. The gcrypt backend was already correct.

    CVE-2026-59848

        An SFTP response with a request id the client did not send could
        cause a denial of service.

    CVE-2026-59850

        A DATA packet on a remotely closed channel could be delivered to a
        callback after the channel was freed.

    For Debian 12 bookworm, these problems have been fixed in version
    0.10.6-0+deb12u3.

    We recommend that you upgrade your libssh packages.

    For the detailed security status of libssh please refer to
    its security tracker page at:
    https://security-tracker.debian.org/tracker/libssh

    Further information about Debian LTS security advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/source-package/libssh");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2019-6111");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-0964");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-0965");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-0966");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-0967");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-0968");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-3731");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-59843");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-59844");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-59845");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-59846");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-59847");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-59848");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-59850");
  script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/bookworm/libssh");
  script_set_attribute(attribute:"solution", value:
"Upgrade the libssh-4 packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-6111");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-0966");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-3731");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/02/19");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/20");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/27");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libssh-4");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libssh-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libssh-doc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libssh-gcrypt-4");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libssh-gcrypt-dev");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:12.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Debian Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}

include('debian_package.inc');

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);

var debian_release = get_kb_item('Host/Debian/release');
if ( isnull(debian_release) ) audit(AUDIT_OS_NOT, 'Debian');
debian_release = chomp(debian_release);
if (! preg(pattern:"^(12)\.[0-9]+", string:debian_release)) audit(AUDIT_OS_NOT, 'Debian 12.0', 'Debian ' + debian_release);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Debian', cpu);

var pkgs = [
    {'release': '12.0', 'prefix': 'libssh-4', 'reference': '0.10.6-0+deb12u3'},
    {'release': '12.0', 'prefix': 'libssh-dev', 'reference': '0.10.6-0+deb12u3'},
    {'release': '12.0', 'prefix': 'libssh-doc', 'reference': '0.10.6-0+deb12u3'},
    {'release': '12.0', 'prefix': 'libssh-gcrypt-4', 'reference': '0.10.6-0+deb12u3'},
    {'release': '12.0', 'prefix': 'libssh-gcrypt-dev', 'reference': '0.10.6-0+deb12u3'}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var _release = NULL;
  var prefix = NULL;
  var reference = NULL;
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['prefix'])) prefix = package_array['prefix'];
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (_release && prefix && reference) {
    if (deb_check(release:_release, prefix:prefix, reference:reference)) flag++;
  }
}

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : deb_report_get()
  );
  exit(0);
}
else
{
  var tested = deb_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'libssh-4 / libssh-dev / libssh-doc / libssh-gcrypt-4 / etc');
}