Fedora 41 : deluge (2025-d23a07ad00)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##
# The descriptive text and package checks in this plugin were
# extracted from Fedora Security Advisory FEDORA-2025-d23a07ad00
#

include('compat.inc');

if (description)
{
  script_id(235686);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/06/26");
  script_xref(name:"FEDORA", value:"2025-d23a07ad00");

  script_name(english:"Fedora 41 : deluge (2025-d23a07ad00)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Fedora host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the
FEDORA-2025-d23a07ad00 advisory.

    https://deluge.readthedocs.io/en/deluge-2.2.0/changelog.html

    2.2.0 (2025-04-28)

    Breaking changes

        Removed Python 3.6 support (Python >= 3.7)

    Core

        Fix GHSL-2024-189 - insecure HTTP for new version check.

        Fix alert handler segfault.

        Add support for creating v2 torrents.

    GTK UI

        Fix changing torrent ownership.

        Fix upper limit of upload/download in Add Torrent dialog.

        Fix #3339 - Resizing window crashes with Piecesbar or Stats plugin.

        Fix #3350 - Unable to use quick search.

        Fix #3598 - Missing AppIndicator option in Preferences.

        Set Appindicator as default for tray icon on Linux.

        Add feature to switch between dark/light themes.

    Web UI

        Fix GHSL-2024-191 - potential flag endpoint path traversal.

        Fix GHSL-2024-188 - js script dir traversal vulnerability.

        Fix GHSL-2024-190 - insecure tracker icon endpoint.

        Fix unable to stop daemon in connection manager.

        Fix responsiveness to avoid Connection lost.

        Add support for network interface name as well as IP address.

        Add ability to change UI theme.

    Console UI

        Fix rm and move commands hanging when done.

        Fix #3538 - Unable to add host in connection manager.

        Disable interactive-mode on Windows.

    UI library

        Fix tracker icon display by converting to png format.

        Fix splitting trackers by newline

        Add clickable URLs for torrent comment and tracker status.

    Label

        Fix torrent deletion not removed from config.

        Fix label display name in submenu.

    AutoAdd

        Fix #3515 - Torrent file decoding errors disabled watch folder.



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://bodhi.fedoraproject.org/updates/FEDORA-2025-d23a07ad00");
  script_set_attribute(attribute:"solution", value:
"Update the affected deluge package.");
  script_set_attribute(attribute:"risk_factor", value:"High");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/05/02");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/05/02");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/05/11");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:41");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:deluge");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Fedora Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'Fedora' >!< os_product) audit(AUDIT_OS_NOT, 'Fedora');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'Fedora');
if (! preg(pattern:"^41([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'Fedora 41', 'Fedora ' + os_version);

if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Fedora', cpu);

var constraints = [
  {
    'release': '41',
    'pkgs': [
      {'reference':'deluge-2.2.0-1.fc41', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'deluge');
}