EulerOS 2.0 SP10 : curl (EulerOS-SA-2026-3687)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(347115);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/18");

  script_cve_id(
    "CVE-2026-8286",
    "CVE-2026-8924",
    "CVE-2026-8927",
    "CVE-2026-9547"
  );
  script_xref(name:"IAVA", value:"2026-A-0627-S");

  script_name(english:"EulerOS 2.0 SP10 : curl (EulerOS-SA-2026-3687)");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS host is missing multiple security updates.");
  script_set_attribute(attribute:"description", value:
"According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the
following vulnerabilities :

    A vulnerability exists where a new transfer that uses STARTTLS to upgrade the
    connection might reuse an existing live connection even though the TLS
    configuration mismatches so it should not.(CVE-2026-8286)

    ['Hello friends,', 'CVE-2026-8286: wrong STARTTLS connection reuse (LOW)', 'CVE-2026-8458: wrong reuse for
    different services (LOW)', 'CVE-2026-8924: traling dot domain super cookie (LOW)', 'CVE-2026-8925: SASL
    double-free (MEDIUM)', 'CVE-2026-8926: password leak with netrc and user in URL (LOW)', 'CVE-2026-8927:
    env-set cross-proxy Digest auth state leak (MEDIUM)', 'CVE-2026-8932: incomplete mTLS config matching in
    conn reuse (LOW)', 'CVE-2026-9079: stale proxy password leak (MEDIUM)', 'CVE-2026-9080: UAF after pause in
    socket callback (LOW)', 'CVE-2026-9545: exposing HTTP/3 early data (LOW)', 'CVE-2026-9546: sending old
    referer (LOW)', 'CVE-2026-9547: SSH improper host validation (LOW)', 'CVE-2026-10536: HTTP/2 stream-
    dependency tree UAF (LOW)', 'CVE-2026-11352: QUIC zero-length UDP datagrams busy-loop (LOW)',
    'CVE-2026-11564: Native CA trust persist (LOW)', 'CVE-2026-11586: WS Auto-PONG memory exhaustion (LOW)',
    'CVE-2026-11856: cross-origin Digest auth state leak (MEDIUM)', 'CVE-2026-12064: proto-default skips SSH
    verification (LOW)', '--\n\n / daniel.haxx.se ||'](CVE-2026-8924)

    When reusing a libcurl handle for sequential transfers driven by
    environment-variable proxy configuration, libcurl fails to clear the proxy
    authentication state between requests. Specifically, if the initial transfer
    authenticates against `proxyA` using Digest auth, a subsequent transfer routed
    through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended
    solely for `proxyA`.(CVE-2026-8927)

    When a libcurl-based application performs transfers via `SCP://` or `SFTP://`
    and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an
    untrusted server. This vulnerability occurs when a server presents a host key
    type that does not match the specific key type already recorded for that host
    in the `known_hosts` file. Instead of rejecting the mismatch, the callback
    mechanism fails to properly enforce the restriction, allowing the connection
    to succeed without warning and risking a potential man-in-the-middle attack.(CVE-2026-9547)

Tenable has extracted the preceding description block directly from the EulerOS curl security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2026-3687
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?6179d7be");
  script_set_attribute(attribute:"solution", value:
"Update the affected curl packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-9547");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-8927");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/18");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:curl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:curl-help");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libcurl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libcurl-devel");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
  script_exclude_keys("Host/EulerOS/uvp_version");

  exit(0);
}

include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var _release = get_kb_item("Host/EulerOS/release");
if (isnull(_release) || _release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
var uvp = get_kb_item("Host/EulerOS/uvp_version");
if (_release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP10");

var sp = get_kb_item("Host/EulerOS/sp");
if (isnull(sp) || sp !~ "^(10)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP10");

if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP10", "EulerOS UVP " + uvp);

if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu && "x86" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "x86" >!< cpu) audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);

var flag = 0;

var pkgs = [
  "curl-7.71.1-4.h31.r11.eulerosv2r10",
  "curl-help-7.71.1-4.h31.r11.eulerosv2r10",
  "libcurl-7.71.1-4.h31.r11.eulerosv2r10",
  "libcurl-devel-7.71.1-4.h31.r11.eulerosv2r10"
];

foreach (var pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", sp:"10", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "curl");
}