EulerOS 2.0 SP12 : ruby (EulerOS-SA-2026-4530)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(376680);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/11/06");

  script_cve_id(
    "CVE-2025-24294",
    "CVE-2026-27820",
    "CVE-2026-47240",
    "CVE-2026-47241",
    "CVE-2026-80212",
    "CVE-2026-80213"
  );

  script_name(english:"EulerOS 2.0 SP12 : ruby (EulerOS-SA-2026-4530)");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS host is missing multiple security updates.");
  script_set_attribute(attribute:"description", value:
"According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the
following vulnerabilities :

    REJECTED Rejected reason: The RubyGems maintainers determined that the reported symlink-following behavior
    during gem extraction is not a security vulnerability, so no vulnerability exists for this record to
    describe.(CVE-2026-82455)

    zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0,
    3.1.1, 3.2.0 and 3.2.1 contain a buffer overflow vulnerability in the Zlib::GzipReader. The
    zstream_buffer_ungets function prepends caller-provided bytes ahead of previously produced output but
    fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing
    data. This can lead to memory corruption when the buffer length exceeds capacity. This issue has been
    fixed in versions 3.0.1, 3.1.2 and 3.2.3.(CVE-2026-27820)

    The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient
    check on the length of a decompressed domain name within a DNS packet._x000D_
    _x000D_
    An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv
    library parses such a packet, the name decompression process consumes a large amount of CPU resources, as
    the library does not limit the resulting length of the name._x000D_
    _x000D_
    This resource consumption can cause the application thread to become unresponsive, resulting in a Denial
    of Service condition.(CVE-2025-24294)

    An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::MessageEncoder wrote a DNS
    label's length into a single octet without checking its range. A label longer than 255 octets had its
    length stored modulo 256 but the label data was written unchanged, and thus the bytes on the wire
    described a different name than the one the application asked to encode. RFC 1035 section 2.3.4 limits a
    label to 63 octets, and the two high bits of the length octet are reserved for compression pointers.
    put_string packed the length with put_pack('C', d.length) and put_label used it for labels, and thus any
    value from 0 to 255 could end up as a label length octet, including the reserved 0x40-0xBF range and the
    0xC0-0xFF pointer range. Resolv::DNS::Name.create did not check per-label or total name length either, and
    thus an attacker-controlled hostname reached the encoder unchanged. An application that resolves an
    attacker-controlled hostname sends a query whose wire bytes name a domain the attacker chose. A hostname
    suffix that the application validates against an allowlist becomes padding that never appears on the wire,
    and thus allowlist and egress checks can be bypassed. The recursive resolver caches the response under the
    attacker's name, and DNS logs record that name rather than the one the application asked for. A label
    length whose low octet lands in the 0xC0-0xFF range produces a length octet that conforming parsers read
    as the start of a compression pointer, with the following attacker-controlled byte as the
    offset.(CVE-2026-80213)

    Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5
    and 0.5.15, several Net::IMAP commands accept a 'raw data' argument that is sent verbatim after validation
    to prevent command injection. However, if a server does not support non-synchronizing literals, it may
    still be possible to inject arbitrary IMAP commands inside non-synchronizing literals.  A server without
    support for non-synchronizing literals may interpret the '+}\r\n' as the end of a malformed command line
    and respond with a tagged BAD. In that case, the contents of the literal will be interpreted as one or
    more new pipelined commands, allowing a CRLF command injection attack to succeed. This affects criteria
    for #search and #uid_search; search_keys for #sort, #thread, #uid_sort, and #uid_thread; and attr for
    #fetch and #uid_fetch. This vulnerability is fixed in 0.6.5 and 0.5.15.(CVE-2026-47240)

    Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5
    and 0.5.15, several Net::IMAP commands accept a raw string argument which is only validated to prevent
    CRLF injection and then sent verbatim. If this string is derived from user-controlled input, an attacker
    can force the next command to be absorbed as a continuation of the first command. This will cause the
    first command to eventually fail, but also prevents it from returning until another command is sent (from
    another thread). That other command will not return until the connection is closed. This vulnerability is
    fixed in 0.6.5 and 0.5.15.(CVE-2026-47241)

    An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.get_class,
    Resolv::DNS::Resource::Generic.create, and Resolv::DNS::SvcParam::Generic.create generate a new class for
    each unknown DNS resource record (type, class) pair, or each unknown SvcParamKey, encountered while
    decoding a response. Each generated class was permanently registered both as a constant on Resource (or
    SvcParam::Generic) and as an entry in a class-lookup hash (ClassHash), and thus the class remained
    reachable through that constant after the response was discarded. Type and class are each 16-bit values,
    and thus an attacker controlling DNS responses (a spoofed response, or a malicious or hijacked upstream
    DNS server) has roughly 2^32 distinct (type, class) pairs to choose from. A single response of a few
    hundred kilobytes carrying tens of thousands of distinct unknown types permanently grows process memory by
    tens of megabytes; repeated responses accumulate without bound and are never reclaimed by garbage
    collection, because the constant keeps each class alive. Any code path that calls
    Resolv::DNS::Message.decode on attacker-influenced DNS responses is affected. resolv is a default gem, and
    thus this is reachable from a plain Ruby installation without any additional dependency.(CVE-2026-80212)

Tenable has extracted the preceding description block directly from the EulerOS ruby security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2026-4530
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?200c4074");
  script_set_attribute(attribute:"solution", value:
"Update the affected ruby packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-27820");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/07/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/11/05");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/11/06");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:ruby");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:ruby-help");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:ruby-irb");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:rubygem-bigdecimal");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:rubygem-did_you_mean");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:rubygem-io-console");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:rubygem-json");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:rubygem-openssl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:rubygem-psych");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:rubygem-rdoc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:rubygems");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
  script_exclude_keys("Host/EulerOS/uvp_version");

  exit(0);
}

include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var _release = get_kb_item("Host/EulerOS/release");
if (isnull(_release) || _release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
var uvp = get_kb_item("Host/EulerOS/uvp_version");
if (_release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP12");

var sp = get_kb_item("Host/EulerOS/sp");
if (isnull(sp) || sp !~ "^(12)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP12");

if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP12", "EulerOS UVP " + uvp);

if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu && "x86" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("aarch64" >!< cpu) audit(AUDIT_ARCH_NOT, "aarch64", cpu);

var flag = 0;

var pkgs = [
  "ruby-3.0.3-128.h21.eulerosv2r12",
  "ruby-help-3.0.3-128.h21.eulerosv2r12",
  "ruby-irb-3.0.3-128.h21.eulerosv2r12",
  "rubygem-bigdecimal-3.0.0-128.h21.eulerosv2r12",
  "rubygem-did_you_mean-1.5.0-128.h21.eulerosv2r12",
  "rubygem-io-console-0.5.7-128.h21.eulerosv2r12",
  "rubygem-json-2.5.1-128.h21.eulerosv2r12",
  "rubygem-openssl-2.2.1-128.h21.eulerosv2r12",
  "rubygem-psych-3.3.2-128.h21.eulerosv2r12",
  "rubygem-rdoc-6.3.3-128.h21.eulerosv2r12",
  "rubygems-3.2.32-128.h21.eulerosv2r12"
];

foreach (var pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", sp:"12", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "ruby");
}