Fedora 44 : varnish (2025-2ff6e32273)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##
# The descriptive text and package checks in this plugin were
# extracted from Fedora Security Advisory FEDORA-2025-2ff6e32273
#

include('compat.inc');

if (description)
{
  script_id(272039);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/10/31");

  script_cve_id("CVE-2023-44487", "CVE-2025-8671");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2023/10/31");
  script_xref(name:"FEDORA", value:"2025-2ff6e32273");
  script_xref(name:"CEA-ID", value:"CEA-2024-0004");

  script_name(english:"Fedora 44 : varnish (2025-2ff6e32273)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Fedora host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the
FEDORA-2025-2ff6e32273 advisory.

    Automatic update for varnish-7.7.3-2.fc44.

    ##### **Changelog**

    ```
    * Wed Oct 29 2025 Lubo Uhliarik <[email protected]> - 7.7.3-2
    - Add tmpfiles.d rules for /var directories (bootc compatibility)
    * Mon Sep 15 2025 Ingvar Hagelund <[email protected]> - 7.7.3-1
    - New upstream release: A security release
    - Includes fix for VSV00017 aka CVE-2025-8671, rhbz#2388222
    * Thu Jul 31 2025 Lubo Uhliarik <[email protected]> - 7.7.1-4
    - bundle jemalloc in RHEL
    * Fri Jul 25 2025 Fedora Release Engineering <[email protected]> - 7.7.1-3
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
    * Thu May 22 2025 Ingvar Hagelund <[email protected]> - 7.7.1-2
    - Correct ABI and VRT versions
    - Pulled el7 support
    - Use systemd setup for users
    * Tue May 20 2025 Lubo Uhliarik <[email protected]> - 7.7.1-1
    - new version 7.7.1
    * Thu Mar 27 2025 Ingvar Hagelund <[email protected]> - 7.7.0-2
    - Fix for eln build (merged from yselkowitz)
    - Fix for failing h2 switch check. Enabling full test suite again
    * Mon Mar 24 2025 Ingvar Hagelund <[email protected]> - 7.7.0-1
    - New upstream release
    - fedora now has completed the bin/sbin merge
    * Sun Jan 19 2025 Fedora Release Engineering <[email protected]> - 7.6.1-2
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
    * Mon Dec  2 2024 Ingvar Hagelund <[email protected]> - 7.6.1-1
    - New upstream release
    * Mon Sep 16 2024 Ingvar Hagelund <[email protected]> - 7.6.0-1
    - New upstream release
    - Updated checkout of pkg-varnish
    * Sat Jul 20 2024 Fedora Release Engineering <[email protected]> - 7.5.0-2
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
    * Tue Mar 19 2024 Ingvar Hagelund <[email protected]> - 7.5.0-1
    - New upstream release
    - Moved somethings around to make the diff from the upstream spec less
    - Upped some memory requirements in some of the tests. Necessary on aarch64 and ppc64le (and ppc32)
    - Reduced number of parallel jobs on s390x builders as builds tend to fail when stressed
    - Retired armv7hl
    * Sat Jan 27 2024 Fedora Release Engineering <[email protected]> - 7.4.2-2
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
    * Wed Nov  8 2023 Ingvar Hagelund <[email protected]> - 7.4.2-1
    - New upstream release. A security release
    - Includes fix for CVE-2023-44487 aka VSV00013, rhbz#2243328, HTTP/2 Rapid Reset Attack

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://bodhi.fedoraproject.org/updates/FEDORA-2025-2ff6e32273");
  script_set_attribute(attribute:"solution", value:
"Update the affected varnish package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:A");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-44487");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/10/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/10/30");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/10/30");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:44");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:varnish");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Fedora Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'Fedora' >!< os_product) audit(AUDIT_OS_NOT, 'Fedora');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'Fedora');
if (! preg(pattern:"^44([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'Fedora 44', 'Fedora ' + os_version);

if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Fedora', cpu);

var constraints = [
  {
    'release': '44',
    'pkgs': [
      {'reference':'varnish-7.7.3-2.fc44', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'varnish');
}