Debian dla-4859 : libcrypto3-udeb - security update

#%NASL_MIN_LEVEL 80900
#
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Debian Security Advisory dla-4859. The text
# itself is copyright (C) Software in the Public Interest, Inc.
#

include('compat.inc');

if (description)
{
  script_id(371990);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/26");

  script_cve_id(
    "CVE-2026-35189",
    "CVE-2026-54872",
    "CVE-2026-75805",
    "CVE-2026-75806",
    "CVE-2026-77696",
    "CVE-2026-84782"
  );
  script_xref(name:"IAVA", value:"2026-A-1072");

  script_name(english:"Debian dla-4859 : libcrypto3-udeb - security update");

  script_set_attribute(attribute:"synopsis", value:
"The remote Debian host is missing one or more security-related updates.");
  script_set_attribute(attribute:"description", value:
"The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the
dla-4859 advisory.

    - -------------------------------------------------------------------------
    Debian LTS Advisory DLA-4859-1                [email protected]
    https://www.debian.org/lts/security/                     Arnaud Rebillout
    October 26, 2026                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : openssl
    Version        : 3.0.22-1~deb12u2
    CVE ID         : CVE-2026-35189 CVE-2026-54872 CVE-2026-75805 CVE-2026-75806
                     CVE-2026-77696 CVE-2026-84782

    Several vulnerabilities have been discovered in OpenSSL, a Secure Socket
    Layer toolkit providing the SSL and TLS cryptographic protocols for
    secure communication over the Internet.

    CVE-2026-35189

        A certificate with many nameRelativeToCRLIssuer CRL distribution
        points causes disproportionate heap growth when OpenSSL caches X.509
        extensions.

    CVE-2026-54872

        The generic elliptic-curve scalar multiplication used for ECDSA and
        SM2 signature operations with curves that do not have a dedicated
        implementation leaks information about the secret nonce through
        timing.

    CVE-2026-75805

        A CMP client that requests certificate revocation on the basis of a
        PKCS#10 CSR may dereference a NULL pointer and terminate abnormally
        when processing a crafted revocation response.

    CVE-2026-75806

        An established DTLS 1.2 association using an AEAD cipher suite can be
        terminated by a single unauthenticated datagram whose encrypted
        fragment is shorter than the mandatory explicit IV and authentication
        tag overhead.

    CVE-2026-77696

        SM2 signature generation uses non-constant-time arithmetic on secret
        values, forming a timing side-channel.

    CVE-2026-84782

        The DTLS retransmission logic does not correctly handle a handshake
        message write that is suspended part-way through. The retransmitted
        message can be read past the message buffer and the retransmission
        overwrites the internal state the suspended write needs to resume
        correctly.

    For Debian 12 bookworm, these problems have been fixed in version
    3.0.22-1~deb12u2.

    We recommend that you upgrade your openssl packages.

    For the detailed security status of openssl please refer to
    its security tracker page at:
    https://security-tracker.debian.org/tracker/openssl

    Further information about Debian LTS security advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/source-package/openssl");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-35189");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-54872");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-75805");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-75806");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-77696");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-84782");
  script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/bookworm/openssl");
  script_set_attribute(attribute:"solution", value:
"Upgrade the libcrypto3-udeb packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-84782");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/29");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/26");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libcrypto3-udeb");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libssl-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libssl-doc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libssl3");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libssl3-udeb");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:openssl");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:12.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Debian Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}

include('debian_package.inc');

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);

var debian_release = get_kb_item('Host/Debian/release');
if ( isnull(debian_release) ) audit(AUDIT_OS_NOT, 'Debian');
debian_release = chomp(debian_release);
if (! preg(pattern:"^(12)\.[0-9]+", string:debian_release)) audit(AUDIT_OS_NOT, 'Debian 12.0', 'Debian ' + debian_release);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Debian', cpu);

var pkgs = [
    {'release': '12.0', 'prefix': 'libcrypto3-udeb', 'reference': '3.0.22-1~deb12u2'},
    {'release': '12.0', 'prefix': 'libssl-dev', 'reference': '3.0.22-1~deb12u2'},
    {'release': '12.0', 'prefix': 'libssl-doc', 'reference': '3.0.22-1~deb12u2'},
    {'release': '12.0', 'prefix': 'libssl3', 'reference': '3.0.22-1~deb12u2'},
    {'release': '12.0', 'prefix': 'libssl3-udeb', 'reference': '3.0.22-1~deb12u2'},
    {'release': '12.0', 'prefix': 'openssl', 'reference': '3.0.22-1~deb12u2'}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var _release = NULL;
  var prefix = NULL;
  var reference = NULL;
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['prefix'])) prefix = package_array['prefix'];
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (_release && prefix && reference) {
    if (deb_check(release:_release, prefix:prefix, reference:reference)) flag++;
  }
}

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : deb_report_get()
  );
  exit(0);
}
else
{
  var tested = deb_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'libcrypto3-udeb / libssl-dev / libssl-doc / libssl3 / libssl3-udeb / etc');
}