Fedora 44 : libmaxminddb (2026-814fe58971)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##
# The descriptive text and package checks in this plugin were
# extracted from Fedora Security Advisory FEDORA-2026-814fe58971
#

include('compat.inc');

if (description)
{
  script_id(302048);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/12");
  script_xref(name:"FEDORA", value:"2026-814fe58971");

  script_name(english:"Fedora 44 : libmaxminddb (2026-814fe58971)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Fedora host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the
FEDORA-2026-814fe58971 advisory.

    # libmaxminddb 1.13.1
    - Re-release for Ubuntu PPA, no code changes.

    # libmaxminddb 1.13.0
    - `MMDB_get_entry_data_list()` now validates that the claimed array/map size is
      plausible given the remaining bytes in the data section. A crafted database
      could previously claim millions of array elements while only having a few
      bytes of data, causing disproportionate memory allocation (memory
      amplification DoS).
    - Fixed integer overflow in `MMDB_read_node()` and `find_ipv4_start_node()`
      pointer arithmetic. The `node_number * record_length` multiplication was
      performed in `uint32_t`, which could overflow for very large databases. Now
      cast to `uint64_t` before multiplying, matching the pattern already used in
      `find_address_in_search_tree()`.
    - Fixed printf format specifier mismatches in `mmdblookup`'s metadata dump. `%i`
      was used for unsigned types and `%llu` for `uint64_t`, which is technically
      undefined behavior. Now uses the portable `PRIu32`, `PRIu16`, and `PRIu64`
      macros from `<inttypes.h>`.
    - Fixed an integer overflow in the search tree bounds check in
      `find_address_in_search_tree()`. The addition of `node_count` and
      `data_section_size` was performed in `uint32_t` arithmetic, which could wrap
      on very large databases, causing valid lookups to be incorrectly rejected as
      corrupt.
    - Fixed a NULL pointer dereference in `mmdblookup` when displaying metadata for
      a database with an out-of-range `build_epoch`. The `gmtime()` return value is
      now checked before passing to `strftime()`.
    - `MMDB_close()` now NULLs the `file_content`, `data_section`, and
      `metadata_section` pointers and zeroes `file_size`, `data_section_size`, and
      `metadata_section_size` after unmapping. Previously, calling `MMDB_close()`
      twice on the same struct (or calling it after a failed `MMDB_open()` that
      succeeded at mapping) would double-munmap the file content, which is undefined
      behavior.
    - Fixed a stack buffer overflow in `print_indentation()` when
      `MMDB_dump_entry_data_list()` was called with a negative `indent` value. The
      negative integer was cast to `size_t`, producing a massive value passed to
      `memset()`. Negative indent values are now clamped to 0.
    - `MMDB_lookup_string()` now sets `*mmdb_error` to `MMDB_SUCCESS` when
      `getaddrinfo` fails (non-zero `*gai_error`). Previously, `*mmdb_error` was
      left uninitialized in this case, which could cause callers to read an
      indeterminate value.
    - Added a recursion depth limit to `skip_map_or_array()`, matching the existing
      `MAXIMUM_DATA_STRUCTURE_DEPTH` (512) limit already used by
      `get_entry_data_list()`. A crafted MMDB file with deeply nested maps or arrays
      could previously cause a stack overflow via unbounded recursion in the
      `MMDB_aget_value` / `MMDB_get_value` code path.
    - Fixed an off-by-one error in `MMDB_read_node()` that allowed reading one node
      past the end of the search tree when called with `node_number == node_count`.
      This caused the function to read from the data section separator and return an
      invalid record with an underflowed data offset. The check now correctly
      rejects `node_number >= node_count`.
    - The handling of float and double types was rewritten to fix compiler errors
      and to eliminate the use of volatile.
    - Improved endian preprocessor check if `MMDB_LITTLE_ENDIAN` is not set.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://bodhi.fedoraproject.org/updates/FEDORA-2026-814fe58971");
  script_set_attribute(attribute:"solution", value:
"Update the affected libmaxminddb package.");
  script_set_attribute(attribute:"risk_factor", value:"High");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/02/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/02/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/03/12");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:44");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:libmaxminddb");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Fedora Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'Fedora' >!< os_product) audit(AUDIT_OS_NOT, 'Fedora');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'Fedora');
if (! preg(pattern:"^44([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'Fedora 44', 'Fedora ' + os_version);

if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Fedora', cpu);

var constraints = [
  {
    'release': '44',
    'pkgs': [
      {'reference':'libmaxminddb-1.13.1-1.fc44', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'libmaxminddb');
}