EulerOS 2.0 SP13 : ruby (EulerOS-SA-2026-2997)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(332957);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/06");

  script_cve_id(
    "CVE-2026-41316",
    "CVE-2026-42245",
    "CVE-2026-42246",
    "CVE-2026-42257",
    "CVE-2026-42258"
  );

  script_name(english:"EulerOS 2.0 SP13 : ruby (EulerOS-SA-2026-2997)");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS host is missing multiple security updates.");
  script_set_attribute(attribute:"description", value:
"According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the
following vulnerabilities :

    Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to
    versions 0.4.24, 0.5.14, and 0.6.4, Net::IMAP::ResponseReader has quadratic time complexity when reading
    large responses containing many string literals. A hostile server can send responses which are crafted to
    exhaust the client's CPU for a denial of service attack. This issue has been patched in versions 0.4.24,
    0.5.14, and 0.6.4.(CVE-2026-42245)

    Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to
    versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to
    return 'successfully', without starting TLS. This issue has been patched in versions 0.3.10, 0.4.24,
    0.5.14, and 0.6.4.(CVE-2026-42246)

    Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to
    versions 0.4.24, 0.5.14, and 0.6.4, symbol arguments to commands are vulnerable to a CRLF Injection / IMAP
    Command injection via Symbol arguments passed to IMAP commands. This issue has been patched in versions
    0.4.24, 0.5.14, and 0.6.4.(CVE-2026-42258)

    Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to
    versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent
    to the server without validation or escaping. If this string is derived from user-controlled input, it may
    contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue
    has been patched in versions 0.4.24, 0.5.14, and 0.6.4.(CVE-2026-42257)

    ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org)
    introduced an `@_init` instance variable guard in `ERB#result` and `ERB#run` to prevent code execution
    when an ERB object is reconstructed via `Marshal.load` (deserialization). However, three other public
    methods that also evaluate `@src` via `eval()` were not given the same guard: `ERB#def_method`,
    `ERB#def_module`, and `ERB#def_class`. An attacker who can trigger `Marshal.load` on untrusted data in a
    Ruby application that has `erb` loaded can use `ERB#def_module` (zero-arg, default parameters) as a code
    execution sink, bypassing the `@_init` protection entirely. ERB 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4 patch
    the issue.(CVE-2026-41316)

Tenable has extracted the preceding description block directly from the EulerOS ruby security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2026-2997
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?36a6cfc1");
  script_set_attribute(attribute:"solution", value:
"Update the affected ruby packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-42257");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-42246");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/04/24");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/06");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:ruby");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:ruby-help");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:ruby-irb");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:rubygem-bigdecimal");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:rubygem-did_you_mean");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:rubygem-io-console");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:rubygem-json");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:rubygem-openssl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:rubygem-psych");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:rubygem-rdoc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:rubygems");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
  script_exclude_keys("Host/EulerOS/uvp_version");

  exit(0);
}

include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var _release = get_kb_item("Host/EulerOS/release");
if (isnull(_release) || _release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
var uvp = get_kb_item("Host/EulerOS/uvp_version");
if (_release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP13");

var sp = get_kb_item("Host/EulerOS/sp");
if (isnull(sp) || sp !~ "^(13)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP13");

if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP13", "EulerOS UVP " + uvp);

if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu && "x86" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "x86" >!< cpu) audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);

var flag = 0;

var pkgs = [
  "ruby-3.0.3-131.h16.eulerosv2r13",
  "ruby-help-3.0.3-131.h16.eulerosv2r13",
  "ruby-irb-3.0.3-131.h16.eulerosv2r13",
  "rubygem-bigdecimal-3.0.0-131.h16.eulerosv2r13",
  "rubygem-did_you_mean-1.5.0-131.h16.eulerosv2r13",
  "rubygem-io-console-0.5.7-131.h16.eulerosv2r13",
  "rubygem-json-2.5.1-131.h16.eulerosv2r13",
  "rubygem-openssl-2.2.1-131.h16.eulerosv2r13",
  "rubygem-psych-3.3.2-131.h16.eulerosv2r13",
  "rubygem-rdoc-6.3.3-131.h16.eulerosv2r13",
  "rubygems-3.2.32-131.h16.eulerosv2r13"
];

foreach (var pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", sp:"13", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "ruby");
}