Debian dla-4876 : python-aiohttp-doc - security update

#%NASL_MIN_LEVEL 80900
#
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Debian Security Advisory dla-4876. The text
# itself is copyright (C) Software in the Public Interest, Inc.
#

include('compat.inc');

if (description)
{
  script_id(374702);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/11/01");

  script_cve_id(
    "CVE-2025-53643",
    "CVE-2025-69223",
    "CVE-2025-69224",
    "CVE-2025-69225",
    "CVE-2025-69226",
    "CVE-2025-69227",
    "CVE-2025-69228",
    "CVE-2025-69229",
    "CVE-2026-22815",
    "CVE-2026-34513",
    "CVE-2026-34514",
    "CVE-2026-34516",
    "CVE-2026-34517",
    "CVE-2026-34518",
    "CVE-2026-34519",
    "CVE-2026-34520",
    "CVE-2026-34525",
    "CVE-2026-34993",
    "CVE-2026-47265",
    "CVE-2026-50269",
    "CVE-2026-54274",
    "CVE-2026-54277",
    "CVE-2026-54279",
    "CVE-2026-54280",
    "CVE-2026-59881",
    "CVE-2026-69243"
  );

  script_name(english:"Debian dla-4876 : python-aiohttp-doc - security update");

  script_set_attribute(attribute:"synopsis", value:
"The remote Debian host is missing one or more security-related updates.");
  script_set_attribute(attribute:"description", value:
"The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the
dla-4876 advisory.

    -------------------------------------------------------------------------
    Debian LTS Advisory DLA-4876-1                [email protected]
    https://www.debian.org/lts/security/                       Daniel Leidert
    October 31, 2026                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : python-aiohttp
    Version        : 3.8.4-1+deb12u2
    CVE ID         : CVE-2025-53643 CVE-2025-69223 CVE-2025-69224 CVE-2025-69225
                     CVE-2025-69226 CVE-2025-69227 CVE-2025-69228 CVE-2025-69229
                     CVE-2026-22815 CVE-2026-34513 CVE-2026-34514 CVE-2026-34516
                     CVE-2026-34517 CVE-2026-34518 CVE-2026-34519 CVE-2026-34520
                     CVE-2026-34525 CVE-2026-34993 CVE-2026-47265 CVE-2026-50269
                     CVE-2026-54274 CVE-2026-54277 CVE-2026-54279 CVE-2026-54280
                     CVE-2026-59881 CVE-2026-69243
    Debian Bug     : 1138780 1138781 1143160 1143597


    Several vulnerabilities have been found in aiohttp, an asynchronous
    HTTP client/server framework for asyncio and Python.


    CVE-2025-53643

       Request smuggling vulnerability due to not parsing trailer sections
       of an HTTP request.

    CVE-2025-69223

       Possible zip bomb attack against the server.

    CVE-2025-69224

       Possible request smuggling attack in the HTTP parser with the
       presence of non-ASCII characters.

    CVE-2025-69225

       The parser logic allows non-ASCII decimals to be present in the
       Range header.

    CVE-2025-69226

       A path traversal vulnerability that allows an attacker to ascertain
       the existence of path components.

    CVE-2025-69227

       When processing a POST body, an infinite loop can occur when assert
       statements are bypassed, leading to a DoS.

    CVE-2025-69228

       Exhausting the memory using Request.post() can freeze the server and
       lead to a DoS.

    CVE-2025-69229

       The handling of chunked messages can result in an excessive blocking
       of CPU usage when receiving a large number of chunks.

    CVE-2026-22815

       An uncapped memory usage due to insufficient restrictions in header
       and trailer handling.

    CVE-2026-34513

       Excessive memory usage possibly resulting in a DoS due to an an
       unbounded DNS cache.

    CVE-2026-34514

       Header injection.

    CVE-2026-34516

       Potential DoS vulnerability caused by a response with an excessive
       number of multipart headers.

    CVE-2026-34517

       Possible excessive memory usage caused by some multipart form fields
       due to reading the entiry field into memory before checking
       client_max_size.

    CVE-2026-34518

       Leaking sensitive information by dropping the Cookie and the Proxy-
       Authorization headers when following redirects to a different
       origin.

    CVE-2026-34519

       Header injection via the reason parameter.

    CVE-2026-34520

       Possible security bypass by checking header values for control
       characters accordingly to RFC 9110.

    CVE-2026-34525

       Disallow duplicate headers, like host headers, except for in lax
       mode.

    CVE-2026-34993

       Arbitrary code execution when using CookieJar.load() with untrusted
       input.

    CVE-2026-47265

       Possible data leak.

    CVE-2026-50269

       An attacker-controlled input included into multipart/payload headers
       can be used to modify a request to inject additional headers or
       similar.

    CVE-2026-54274

       An attacker can send large incomplete websocket frame payloads and
       bypasses the usual size limits on memory use.

    CVE-2026-54277

       An attacker may be able to send oversized lines through the HTTP
       parser and use an excessive amount of memory, potentially leading to
       a DoS.

    CVE-2026-54279

       Host-only cookies saved with CookieJar.save() and then later
       restored with CookieJar.load() lose their host-only status.

    CVE-2026-54280

       Possible resource starvation caused when payload resources are not
       closed correctly when a client disconnects in the middle of a write.

    CVE-2026-59881

       The WebSocket client accepts and decompresses frames with the RSV1
       bit set even when the permessage-deflate extension was not
       negotiated, allowing a malicious server to cause unexpected CPU and
       memory consumption.

    CVE-2026-69243

       The HTTP parsers are vulnerable to a request smuggling attack
       relating to WebSocket upgrades.


    For Debian 12 bookworm, these problems have been fixed in version
    3.8.4-1+deb12u2.

    We recommend that you upgrade your python-aiohttp packages.

    For the detailed security status of python-aiohttp please refer to
    its security tracker page at:
    https://security-tracker.debian.org/tracker/python-aiohttp

    Further information about Debian LTS security advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://wiki.debian.org/LTS
    Attachment:
    signature.asc
    Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://security-tracker.debian.org/tracker/source-package/python-aiohttp
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4b73efdc");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2025-53643");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2025-69223");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2025-69224");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2025-69225");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2025-69226");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2025-69227");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2025-69228");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2025-69229");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-22815");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-34513");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-34514");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-34516");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-34517");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-34518");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-34519");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-34520");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-34525");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-34993");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-47265");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-50269");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-54274");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-54277");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-54279");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-54280");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-59881");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-69243");
  script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/bookworm/python-aiohttp");
  script_set_attribute(attribute:"solution", value:
"Upgrade the python-aiohttp-doc packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-47265");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-54277");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/07/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/31");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/11/01");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:python-aiohttp-doc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:python3-aiohttp");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:12.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Debian Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}

include('debian_package.inc');

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);

var debian_release = get_kb_item('Host/Debian/release');
if ( isnull(debian_release) ) audit(AUDIT_OS_NOT, 'Debian');
debian_release = chomp(debian_release);
if (! preg(pattern:"^(12)\.[0-9]+", string:debian_release)) audit(AUDIT_OS_NOT, 'Debian 12.0', 'Debian ' + debian_release);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Debian', cpu);

var pkgs = [
    {'release': '12.0', 'prefix': 'python-aiohttp-doc', 'reference': '3.8.4-1+deb12u2'},
    {'release': '12.0', 'prefix': 'python3-aiohttp', 'reference': '3.8.4-1+deb12u2'}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var _release = NULL;
  var prefix = NULL;
  var reference = NULL;
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['prefix'])) prefix = package_array['prefix'];
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (_release && prefix && reference) {
    if (deb_check(release:_release, prefix:prefix, reference:reference)) flag++;
  }
}

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : deb_report_get()
  );
  exit(0);
}
else
{
  var tested = deb_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'python-aiohttp-doc / python3-aiohttp');
}