EulerOS Virtualization 2.10.0 : openssl (EulerOS-SA-2026-1187)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(297304);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/31");

  script_cve_id("CVE-2024-13176", "CVE-2025-9230");
  script_xref(name:"IAVA", value:"2025-A-0127-S");
  script_xref(name:"IAVA", value:"2025-A-0716-S");

  script_name(english:"EulerOS Virtualization 2.10.0 : openssl (EulerOS-SA-2026-1187)");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS Virtualization host is missing multiple security updates.");
  script_set_attribute(attribute:"description", value:
"According to the versions of the openssl packages installed, the EulerOS Virtualization installation on the remote host
is affected by the following vulnerabilities :

    Issue summary: An application trying to decrypt CMS messages encrypted using
    password based encryption can trigger an out-of-bounds read and write.

    Impact summary: This out-of-bounds read may trigger a crash which leads to
    Denial of Service for an application. The out-of-bounds write can cause
    a memory corruption which can have various consequences including
    a Denial of Service or Execution of attacker-supplied code.

    Although the consequences of a successful exploit of this vulnerability
    could be severe, the probability that the attacker would be able to
    perform it is low. Besides, password based (PWRI) encryption support in CMS
    messages is very rarely used. For that reason the issue was assessed as
    Moderate severity according to our Security Policy.

    The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this
    issue, as the CMS implementation is outside the OpenSSL FIPS module
    boundary.(CVE-2025-9230)

    Issue summary: A timing side-channel which could potentially allow recovering
    the private key exists in the ECDSA signature computation.

    Impact summary: A timing side-channel in ECDSA signature computations
    could allow recovering the private key by an attacker. However, measuring
    the timing would require either local access to the signing application or
    a very fast network connection with low latency.

    There is a timing signal of around 300 nanoseconds when the top word of
    the inverted ECDSA nonce value is zero. This can happen with significant
    probability only for some of the supported elliptic curves. In particular
    the NIST P-521 curve is affected. To be able to measure this leak, the attacker
    process must either be located in the same physical computer or must
    have a very fast network connection with low latency. For that reason
    the severity of this vulnerability is Low.

    The FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue.(CVE-2024-13176)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization openssl security
advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2026-1187
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b26e1320");
  script_set_attribute(attribute:"solution", value:
"Update the affected openssl packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-9230");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2024-13176");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/04/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/01/30");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/01/31");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:openssl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:openssl-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:openssl-perl");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:uvp:2.10.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/uvp_version");

  exit(0);
}

include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var _release = get_kb_item("Host/EulerOS/release");
if (isnull(_release) || _release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
var uvp = get_kb_item("Host/EulerOS/uvp_version");
if (uvp != "2.10.0") audit(AUDIT_OS_NOT, "EulerOS Virtualization 2.10.0");
if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu && "x86" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "x86" >!< cpu) audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);

var flag = 0;

var pkgs = [
  "openssl-1.1.1f-8.h47.r7.eulerosv2r10",
  "openssl-libs-1.1.1f-8.h47.r7.eulerosv2r10",
  "openssl-perl-1.1.1f-8.h47.r7.eulerosv2r10"
];

foreach (var pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "openssl");
}