Fedora 44 : valkey (2026-3d18a65cc4)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##
# The descriptive text and package checks in this plugin were
# extracted from Fedora Security Advisory FEDORA-2026-3d18a65cc4
#

include('compat.inc');

if (description)
{
  script_id(331316);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/30");

  script_cve_id("CVE-2026-56684", "CVE-2026-63639");
  script_xref(name:"FEDORA", value:"2026-3d18a65cc4");

  script_name(english:"Fedora 44 : valkey (2026-3d18a65cc4)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Fedora host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the
FEDORA-2026-3d18a65cc4 advisory.

    ## Valkey 9.0.5  -  Released Tue 21 July 2026

    Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

    ### Security Fixes

    * **CVE-2026-56684**: Fix a use-after-free in TLS connection handling that could allow an authenticated
    client to achieve remote code execution using CLIENT KILL (#4234)
    * **CVE-2026-63639**: Reject corrupt stream RDB files containing a shared NACK across consumers, which
    could allow remote code execution. Reported by @z0v3r1n and @lifip. (#4073)

    ### Bug Fixes

    * Strictly validate CRLF terminators when parsing the RESP protocol; malformed requests now get a protocol
    error instead of being misparsed by @enjoy-binbin (#2872)
    * Fix a use-after-free crash when creating slot import jobs during manual slot migrations by @twooster
    (#3283)
    * Fix a memory leak in ZDIFF and ZDIFFSTORE when the result set becomes empty before all inputs are
    processed by @sarthakaggarwal97 (#3342)
    * Fix HPERSIST sending a malformed reply that desynchronized the connection when used on a key of the
    wrong type by @madolson (#3516)
    * Fix a crash from a race between IO threads and asynchronous client freeing by @deepakrn (#3458)
    * Fix a double free when loading a stream with corrupt consumer PEL data from RDB or RESTORE by @enjoy-
    binbin (#3498)
    * Fix listpack corruption and a subsequent crash when XTRIM marks the last entry of a stream listpack node
    as deleted by @smkher (#3591)
    * Fix malformed replies when module callbacks build deferred-length arrays while a client's deferred reply
    buffer is active by @eifrah-aws (#3578)
    * Fix a NULL pointer crash in TLS pending-data handling by @zuiderkwast (#3641)
    * Fix a server crash when multiple RDMA clients disconnect at the same time by @quanyeyang (#3448)
    * Fix a use-after-free when ACL LOAD deletes a user whose clients cannot be freed immediately by @ranshid
    (#3800)
    * Fix a use-after-free when a module unregisters the first registered cluster message receiver for a
    message type by @eifrah-aws (#3846)
    * Fix HRANDFIELD looping forever when a hash has fewer non-expired fields than the requested count by
    @cjx-zar (#4047)
    * Fix clients being left on the wrong database after module keyspace notifications for commands like MOVE
    and COPY by @enjoy-binbin (#4024)
    * Fix a Sentinel crash during coordinated failover when the connection to the old primary is disconnected
    by @lukepalmer (#4068)
    * Fix underestimation of client output buffer memory when replies reference shared objects, so buffer
    limits are enforced correctly by @dvkashapov (#3306)
    * Fix a crash on ARM/aarch64 caused by memory-ordering races in the IO thread job queue by @jjuleslasarte
    (#3878)
    * Fix a crash when active hash field expiration leaves a single entry in a large expiration time-bucket by
    @ranshid (#3950)
    * Fix a file descriptor leak when a blocking connection attempt, such as MIGRATE to an unreachable host,
    times out by @madolson (#3541)
    * Fix a potential crash from a dangling slot migration job reference when the migration client is reset by
    @murphyjacob4 (#3554)
    * Remove cached EVAL scripts when their scripting engine is unregistered, preventing dangling engine
    references by @eifrah-aws (#3503)
    * Fix a memory leak in GEOSEARCH BYPOLYGON when argument parsing fails, such as on an invalid COUNT by
    @bandalgomsu (#3568)
    * Fix a crash when a slot migration target node is removed from the cluster before the migration connects
    by @chenshi5012 (#3596)
    * Fix a crash when the module GetLRU/SetLRU/GetLFU/SetLFU APIs are called with a NULL key by @yaronsananes
    (#3610)
    * Fix an assertion failure in hash field expiration commands when a module blocks the client in a keyspace
    notification by @enjoy-binbin (#3743)
    * Fix a cluster UPDATE log message reading shard IDs past their fixed-length buffer by @enjoy-binbin
    (#3942)
    * Fix undefined behavior in the failover delay calculation when cluster-node-timeout is set below 30
    milliseconds by @enjoy-binbin (#3941)
    * Reject zipmap RESTORE payloads with overflowing length fields that could cause out-of-bounds access on
    32-bit builds by @madolson (#3920)
    * Reject NAN scores in listpack- and ziplist-encoded sorted sets on RDB/RESTORE load, preventing a later
    crash on skiplist conversion by @madolson (#3921)
    * Fix a startup crash on 32-bit systems with 64-bit time_t, such as Alpine 3.23, caused by time value
    formatting mismatches by @chenshi5012 (#3787)
    * Fix corrupted client replies when IO threads are enabled, caused by a race between in-flight writes and
    reply buffer reuse by @nanyan0312 (#4060)
    * COMMAND INFO in RESP3 now returns the subcommands field as an Array instead of a Set for commands
    without subcommands by @rickrams (#3939)
    * The dual-channel replication RDB connection now announces the configured replica-announce-ip, avoiding
    stale replica entries behind NAT by @jdheyburn (#2846)
    * Prevent replicas from processing stale cluster packets and incorrectly promoting themselves to an empty
    primary within a shard by @zhijun42 (#2811)
    * Send the replica version on the dual-channel RDB connection so full syncs of data like hash field TTLs
    no longer fail by @hpatro (#4105)
    * Fix slot migration failure handling running twice on ownership changes and an out-of-order error reply
    in the internal SYNCSLOTS FINISH command by @chx9 (#3723)
    * Allow slot-migration-max-failover-repl-bytes to be set to -1 to disable the limit, as documented by
    @enjoy-binbin (#3443)
    * Fix CONFIG REWRITE producing negative values for memory configs such as maxmemory when set to very large
    values by @enjoy-binbin (#3440)
    * Reject SENTINEL SET values containing control characters and safely quote Sentinel config values to
    prevent config file injection by @eifrah-aws (#3847)
    * Reject control characters and delimiters in cluster AUX fields and validate cluster-announce-ip to
    prevent nodes.conf corruption or injection by @eifrah-aws (#3848)
    * Fix changes to lua-enable-insecure-api via CONFIG SET not taking effect when the option was set at
    startup by @enjoy-binbin (#4182)
    * Fix incorrect memory overhead reported for watched keys in client memory usage tracking by @enjoy-binbin
    (#3359)
    * Replica logs now report 'Connection reset by peer' instead of the misleading 'Success' when the primary
    closes the connection by @abmathur-ie (#3580)
    * Redact key names and user data from more log messages when hide-user-data-from-log is enabled by
    @zackcam (#3872)
    * Fix INFO replication reporting negative sync transfer sizes when the RDB exceeds 2GB during disk-based
    sync by @chx9 (#3811)
    * Increase the maximum process title length from 255 to 1024 characters to avoid truncation with long
    installation paths by @pkhartsk (#3843)
    * valkey-cli --cluster del-node can now remove unreachable or failed nodes instead of failing with 'No
    such node ID' by @yang-z-o (#3209)
    * Fix valkey-cli crashing after --eval script execution on jemalloc/tcmalloc builds by @bandalgomsu
    (#3281)
    * valkey-cli --cluster fix now spreads uncovered slots randomly across primaries instead of assigning them
    all to one node by @abmathur-ie (#3586)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://bodhi.fedoraproject.org/updates/FEDORA-2026-3d18a65cc4");
  script_set_attribute(attribute:"solution", value:
"Update the affected valkey package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:S/C:N/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-63639");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/22");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/30");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:44");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:valkey");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Fedora Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'Fedora' >!< os_product) audit(AUDIT_OS_NOT, 'Fedora');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'Fedora');
if (! preg(pattern:"^44([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'Fedora 44', 'Fedora ' + os_version);

if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Fedora', cpu);

var constraints = [
  {
    'release': '44',
    'pkgs': [
      {'reference':'valkey-9.0.5-1.fc44', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_NOTE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'valkey');
}