EulerOS 2.0 SP15 : curl (EulerOS-SA-2026-3969)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(364082);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/08");

  script_cve_id(
    "CVE-2026-8286",
    "CVE-2026-8924",
    "CVE-2026-8926",
    "CVE-2026-8927",
    "CVE-2026-9547",
    "CVE-2026-10536",
    "CVE-2026-12064"
  );

  script_name(english:"EulerOS 2.0 SP15 : curl (EulerOS-SA-2026-3969)");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS host is missing multiple security updates.");
  script_set_attribute(attribute:"description", value:
"According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the
following vulnerabilities :

    A use-after-free vulnerability exists in libcurl when an application_x000D_
    configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or_x000D_
    `CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and_x000D_
    finally terminates the handle with `curl_easy_cleanup()`. During this final_x000D_
    cleanup phase, libcurl attempts to access and modify an internal structure_x000D_
    that was already freed during the reset operation.(CVE-2026-10536)

    When a user invokes curl using a schemeless URL combined with_x000D_
    `--proto-default` sftp (or scp), a disconnect occurs between the tool layer_x000D_
    and libcurl. The tool layer incorrectly infers the URL scheme, which_x000D_
    erroneously bypasses the initialization of critical SSH security options like_x000D_
    CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the_x000D_
    libcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes_x000D_
    the connection via SFTP/SCP as specified. Because the tool layer skipped the_x000D_
    security configuration, these SSH host verification options are silently_x000D_
    omitted, causing curl to connect to an unverified SSH remote host without_x000D_
    throwing an error.(CVE-2026-12064)

    A vulnerability exists where a new transfer that uses STARTTLS to upgrade the_x000D_
    connection might reuse an existing live connection even though the TLS_x000D_
    configuration mismatches so it should not.(CVE-2026-8286)

    When asking curl to use a `.netrc` file to find credentials and at the same_x000D_
    time specifying a URL with a username(without a password), like_x000D_
    `https://[email protected]/`, curl could wrongly get and use the password for_x000D_
    *another* user set in the `.netrc` file for that host if such a one exists and_x000D_
    there is no match for the specified user.(CVE-2026-8926)

    When reusing a libcurl handle for sequential transfers driven by_x000D_
    environment-variable proxy configuration, libcurl fails to clear the proxy_x000D_
    authentication state between requests. Specifically, if the initial transfer_x000D_
    authenticates against `proxyA` using Digest auth, a subsequent transfer routed_x000D_
    through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended_x000D_
    solely for `proxyA`.(CVE-2026-8927)

    When a libcurl-based application performs transfers via `SCP://` or `SFTP://`_x000D_
    and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an_x000D_
    untrusted server. This vulnerability occurs when a server presents a host key_x000D_
    type that does not match the specific key type already recorded for that host_x000D_
    in the `known_hosts` file. Instead of rejecting the mismatch, the callback_x000D_
    mechanism fails to properly enforce the restriction, allowing the connection_x000D_
    to succeed without warning and risking a potential man-in-the-middle attack.(CVE-2026-9547)

    A flaw in curl's cookie parsing logic allows a malicious HTTP server to set_x000D_
    'super cookies' that bypass the Public Suffix List check. This enables an_x000D_
    attacker-controlled origin to inject cookies that curl subsequently scopes and_x000D_
    transmits to unrelated third-party domains.(CVE-2026-8924)

Tenable has extracted the preceding description block directly from the EulerOS curl security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2026-3969
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e6dd1b08");
  script_set_attribute(attribute:"solution", value:
"Update the affected curl packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-10536");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/08");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:curl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:curl-help");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libcurl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libcurl-devel");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
  script_exclude_keys("Host/EulerOS/uvp_version");

  exit(0);
}

include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var _release = get_kb_item("Host/EulerOS/release");
if (isnull(_release) || _release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
var uvp = get_kb_item("Host/EulerOS/uvp_version");
if (_release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP15");

var sp = get_kb_item("Host/EulerOS/sp");
if (isnull(sp) || sp !~ "^(15)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP15");

if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP15", "EulerOS UVP " + uvp);

if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu && "x86" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("aarch64" >!< cpu) audit(AUDIT_ARCH_NOT, "aarch64", cpu);

var flag = 0;

var pkgs = [
  "curl-8.4.0-14.h21510.19.eulerosv2r15",
  "curl-help-8.4.0-14.h21510.19.eulerosv2r15",
  "libcurl-8.4.0-14.h21510.19.eulerosv2r15",
  "libcurl-devel-8.4.0-14.h21510.19.eulerosv2r15"
];

foreach (var pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", sp:"15", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "curl");
}