Fedora 43 : valkey (2026-cda5ad190f)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##
# The descriptive text and package checks in this plugin were
# extracted from Fedora Security Advisory FEDORA-2026-cda5ad190f
#

include('compat.inc');

if (description)
{
  script_id(344480);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/10");
  script_xref(name:"FEDORA", value:"2026-cda5ad190f");

  script_name(english:"Fedora 43 : valkey (2026-cda5ad190f)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Fedora host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the
FEDORA-2026-cda5ad190f advisory.

    ## Valkey 8.1.10  -  Released Mon 31 August 2026

    Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

    ### Security Fixes

    * GHSA-jcj7-v34w-v9vv: Fix a use-after-free in RDMA connection handling that could allow an authenticated
    client to crash the server using CLIENT KILL. Only affects servers built with USE_RDMA and configured with
    an RDMA listener (#4534)

    ### Bug Fixes

    * Fix a double free when a module timer callback stops its own timer with `ValkeyModule_StopTimer` by
    @quanyeyang (#4211)
    * RESET now clears the `CLIENT IMPORT-SOURCE` flag so reused pooled connections stop reading logically
    expired keys by @tjade273 (#3973)
    * Fix AOF recovery of a truncated MULTI/EXEC block that could cause new writes to be lost after a
    subsequent restart by @chzhoo (#4342)
    * Fix an ACL bypass where duplicate STORE/STOREDIST options in GEORADIUS commands escaped key write
    permission checks by @tjade273 (#3971)
    * Fix a use-after-free crash when a cluster message of a module-registered type arrives after the module
    is unloaded by @enjoy-binbin (#4360)
    * Fix out-of-bounds access when registering or receiving cluster module messages of type 255, which is now
    fully supported by @enjoy-binbin (#4410)
    * Skip ACL permission checks when replaying the AOF, preventing silent data loss when users are restricted
    or disabled by @lukepalmer (#3984)
    * Fix a client memory accounting leak that inflated `mem_clients_normal` on replicas after disconnecting
    from the primary by @enjoy-binbin (#4395)
    * Always validate listpacks on RDB load and RESTORE to prevent deferred crashes; `sanitize-dump-payload`
    and the related ACL flags are now deprecated no-ops by @jjuleslasarte (#3721)
    * Fix a stack overflow crash when retrying large TLS writes after an OpenSSL write error by @murphyjacob4
    (#4307)
    * Validate PUBLISH and MODULE cluster bus packet lengths, preventing a crash from forged packets with
    oversized payload lengths by @tjade273 (#3972)
    * Reject crafted stream RESTORE/RDB payloads with inconsistent lengths or negative field counts that could
    crash the server by @madolson (#3922)
    * Fix a use-after-free crash when serving multiple clients blocked on the same key if one is freed during
    processing by @quanyeyang (#4212)
    * Fix CLUSTER SLOT-STATS ORDERBY sorting when slot statistics differ by more than 2^31 by @jzy1688 (#4459)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://bodhi.fedoraproject.org/updates/FEDORA-2026-cda5ad190f");
  script_set_attribute(attribute:"solution", value:
"Update the affected valkey package.");
  script_set_attribute(attribute:"risk_factor", value:"High");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/01");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/10");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:43");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:valkey");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Fedora Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'Fedora' >!< os_product) audit(AUDIT_OS_NOT, 'Fedora');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'Fedora');
if (! preg(pattern:"^43([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'Fedora 43', 'Fedora ' + os_version);

if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Fedora', cpu);

var constraints = [
  {
    'release': '43',
    'pkgs': [
      {'reference':'valkey-8.1.10-1.fc43', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'valkey');
}