EulerOS Virtualization 2.10.0 : gnutls (EulerOS-SA-2026-3868)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(348521);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/21");

  script_cve_id("CVE-2026-5260", "CVE-2026-42012", "CVE-2026-42013");
  script_xref(name:"IAVA", value:"2026-A-0405");

  script_name(english:"EulerOS Virtualization 2.10.0 : gnutls (EulerOS-SA-2026-3868)");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS Virtualization host is missing multiple security updates.");
  script_set_attribute(attribute:"description", value:
"According to the versions of the gnutls packages installed, the EulerOS Virtualization installation on the remote host
is affected by the following vulnerabilities :

    A vulnerability was found in Apache HTTP Server up to 2.4.67 (Web Server) and classified as critical.Using
    CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the
    buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the
    buffer was allocated using a routine such as malloc().Impacted is confidentiality, integrity, and
    availability.Upgrading to version 2.4.68 eliminates this vulnerability.(CVE-2026-42536)

    Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and
    ProxyPassReverseCookie* This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.Users are
    recommended to upgrade to version 2.4.68, which fixes the issue.(CVE-2026-34356)

    Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the mod_proxy_ftp module in Apache
    HTTP Server with an attacker controlled backend FTP server.This issue affects undefined: from 2.4.0
    through 2.4.67.Users are recommended to upgrade to version 2.4.68, which fixes the issue.(CVE-2026-44186)

    Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the
    configuration.This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.Users are recommended to
    upgrade to version 2.4.68, which fixes the issue.(CVE-2026-44631)

    A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier  allows a WebDAV content author to
    directly manipulate trusted DAV property databases, potentially causing child process crashes.Users are
    recommended to upgrade to version 2.4.68, which fixes this issue.(CVE-2026-42535)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization gnutls security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2026-3868
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0721ff3e");
  script_set_attribute(attribute:"solution", value:
"Update the affected gnutls packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-5260");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/04/30");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/21");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/21");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:gnutls");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:gnutls-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:gnutls-help");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:gnutls-utils");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:uvp:2.10.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/uvp_version");

  exit(0);
}

include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var _release = get_kb_item("Host/EulerOS/release");
if (isnull(_release) || _release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
var uvp = get_kb_item("Host/EulerOS/uvp_version");
if (uvp != "2.10.0") audit(AUDIT_OS_NOT, "EulerOS Virtualization 2.10.0");
if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu && "x86" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "x86" >!< cpu) audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);

var flag = 0;

var pkgs = [
  "gnutls-3.6.14-6.h25.eulerosv2r10",
  "gnutls-devel-3.6.14-6.h25.eulerosv2r10",
  "gnutls-help-3.6.14-6.h25.eulerosv2r10",
  "gnutls-utils-3.6.14-6.h25.eulerosv2r10"
];

foreach (var pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "gnutls");
}