Fedora 42 : libsodium (2026-b7217393db)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##
# The descriptive text and package checks in this plugin were
# extracted from Fedora Security Advisory FEDORA-2026-b7217393db
#

include('compat.inc');

if (description)
{
  script_id(282563);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/11");

  script_cve_id("CVE-2025-69277");
  script_xref(name:"IAVA", value:"2026-A-0014");
  script_xref(name:"FEDORA", value:"2026-b7217393db");

  script_name(english:"Fedora 42 : libsodium (2026-b7217393db)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Fedora host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the
FEDORA-2026-b7217393db advisory.

    **Version 1.0.21**

     This point release includes all the changes from 1.0.20-stable, which
    include a security fix for the `crypto_core_ed25519_is_valid_point()`
    function, as well as two new sets of functions:

     - The new `crypto_ipcrypt_*` functions implement mechanisms for securely
    encrypting and anonymizing IP addresses as specified in https://ipcrypt-std.github.io
     - The `sodium_bin2ip` and `sodium_ip2bin` helper functions have been added
    to complement the `crypto_ipcrypt_*` functions and easily convert addresses
    between bytes and strings.
     - XOF: the `crypto_xof_shake*` and `crypto_xof_turboshake*` functions
    are standard extendable output functions. From input of any length, they can
    derive output of any length with the same properties as hash functions. These
    primitives are required by many post-quantum mechanisms, but can also be used
    for a wide range of applications, including key derivation, session encryption
    and more.

    ----

    **Version 1.0.20-stable**

     - XCFramework: cross-compilation is now forced on Apple Silicon to
    avoid Rosetta-related build issues
     - The Fil-C compiler is supported out of the box
     - The CompCert compiler is supported out of the box
     - MSVC 2026 (Visual Studio 2026) is now supported
     - Zig builds now support FreeBSD targets
     - Performance of AES256-GCM and AEGIS on ARM has been improved
    with some compilers
     - Android binaries have been added to the NuGet package
     - Windows ARM binaries have been added to the NuGet package
     - The Android build script has been improved. The base SDK is
    now 27c, and the default platform is 21, supporting 16 KB page sizes.
     - The library can now be compiled with Zig 0.15 and Zig 0.16
     - Zig builds now generate position-independent static libraries by
    default on targets that support PIC
     - arm64e builds have been added to the XCFramework packages
     - XCFramework packages are now full builds instead of minimal
    builds
     - MSVC builds have been enabled for ARM64
     - iOS 32-bit (armv7/armv7s) support has been removed from the
    XCFramework build script
     - Security: optblockers have been introduced in critical code paths
    to prevent compilers from introducing unwanted side channels via
    conditional jumps. This was observed on RISC-V targets with specific
    compilers and options.
     - Security: `crypto_core_ed25519_is_valid_point()` now properly
    rejects small-order points that are not in the main subgroup
     - `((nonnull))` attributes have been relaxed on some `crypto_stream*`
    functions to allow NULL output buffers when the output length is zero
     - A cross-compilation issue with old clang versions has been
    fixed
     - JavaScript: support for Cloudflare Workers has been added
     - JavaScript: WASM_BIGINT is forcibly disabled to retain
    compatibility with older runtimes
     - A compilation issue with old toolchains on Solaris has been
    fixed
     - `crypto_aead_aes256gcm_is_available` is exported to JavaScript
     - libsodium is now compatible with Emscripten 4.x
     - Security: memory fences have been added after MAC verification in
    AEAD to prevent speculative access to plaintext before authentication
    is complete
     - Assembly files now include .gnu.property notes for proper IBT and
    Shadow Stack support when building with CET instrumentation


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://bodhi.fedoraproject.org/updates/FEDORA-2026-b7217393db");
  script_set_attribute(attribute:"solution", value:
"Update the affected libsodium package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:H/Au:N/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-69277");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/12/31");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/01/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/01/11");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:42");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:libsodium");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Fedora Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'Fedora' >!< os_product) audit(AUDIT_OS_NOT, 'Fedora');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'Fedora');
if (! preg(pattern:"^42([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'Fedora 42', 'Fedora ' + os_version);

if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Fedora', cpu);

var constraints = [
  {
    'release': '42',
    'pkgs': [
      {'reference':'libsodium-1.0.21-2.fc42', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_NOTE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'libsodium');
}