Fedora 43 : python-streamlink (2026-d8cf5f20d7)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##
# The descriptive text and package checks in this plugin were
# extracted from Fedora Security Advisory FEDORA-2026-d8cf5f20d7
#

include('compat.inc');

if (description)
{
  script_id(374881);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/11/02");

  script_cve_id("CVE-2026-92164");
  script_xref(name:"FEDORA", value:"2026-d8cf5f20d7");

  script_name(english:"Fedora 43 : python-streamlink (2026-d8cf5f20d7)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Fedora host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the
FEDORA-2026-d8cf5f20d7 advisory.

    ## streamlink 8.6.2 (2026-10-07)

    - SECURITY: fixed arbitrary local file read via `file://` URLs in DASH `Location` tags (`CVE-2026-TO-BE-
    ASSIGNED` / [`GHSA-j7pf-m7gx-
    jr33`](https://github.com/streamlink/streamlink/security/advisories/GHSA-j7pf-m7gx-jr33))
    ([`98781761`](https://github.com/streamlink/streamlink/commit/987817618f57b6def852693e4e0a95fd9c8437f2))
    - Changed: `validate.xml_xpath()` and `validate.xml_xpath_string()` to include access to `re:test()`,
    `re:match()` and `re:replace()` regex functions
    ([#7151](https://github.com/streamlink/streamlink/pull/7151))
    - Changed: log format of deprecation warnings
    ([#7141](https://github.com/streamlink/streamlink/pull/7141))
    - Fixed: missing deprecation warnings for already deprecated CLI arguments (req. Python 3.13+)
    ([#7141](https://github.com/streamlink/streamlink/pull/7141))
    - Fixed: being able to close `SegmentedStreamReader` streams without opening them first, emitting log
    records on garbage collection ([#7146](https://github.com/streamlink/streamlink/pull/7146))
    - Updated plugins:
      - blazetv: fixed live streams ([#7147](https://github.com/streamlink/streamlink/pull/7147))
      - cinergroup: fixed Bloomberg HT ([#7132](https://github.com/streamlink/streamlink/pull/7132))
      - dogan: fixed plugin ([#7138](https://github.com/streamlink/streamlink/pull/7138))
      - facebook: re-introduced plugin with new implementation
    ([#7115](https://github.com/streamlink/streamlink/pull/7115))
      - vimeo: rewritten and fixed plugin ([#7069](https://github.com/streamlink/streamlink/pull/7069))
      - youtvua: added new plugin ([#7140](https://github.com/streamlink/streamlink/pull/7140))
    - Docs: tightened rules about AI-assisted contributions and security vulnerability reports
    ([#7136](https://github.com/streamlink/streamlink/pull/7136),
    [#7152](https://github.com/streamlink/streamlink/pull/7152))

    [Full changelog](https://github.com/streamlink/streamlink/compare/8.6.1...8.6.2)


    ## streamlink 8.6.1 (2026-09-16)

    - Fixed: compatibility with urllib3 2.8.0 ([#7117](https://github.com/streamlink/streamlink/pull/7117))

    [Full changelog](https://github.com/streamlink/streamlink/compare/8.6.0...8.6.1)


    ## streamlink 8.6.0 (2026-09-13)

    - SECURITY: fixed arbitrary local file read via HTTP(S) redirection to `file://` URL
    ([`CVE-2026-92164`](https://nvd.nist.gov/vuln/detail/CVE-2026-92164) / [`GHSA-
    vf2x-4v53-pm7v`](https://github.com/streamlink/streamlink/security/advisories/GHSA-vf2x-4v53-pm7v))
    ([`4b99c64d`](https://github.com/streamlink/streamlink/commit/4b99c64dde21ea70c24d9ffdbd15849b05f465c6))
    - SECURITY: fixed insecure cross-scheme redirection (HTTPS -> HTTP)
    ([`CVE-2026-92164`](https://nvd.nist.gov/vuln/detail/CVE-2026-92164) / [`GHSA-
    vf2x-4v53-pm7v`](https://github.com/streamlink/streamlink/security/advisories/GHSA-vf2x-4v53-pm7v))
    ([`4b99c64d`](https://github.com/streamlink/streamlink/commit/4b99c64dde21ea70c24d9ffdbd15849b05f465c6))
    - Added: official support for Python 3.15 ([#7026](https://github.com/streamlink/streamlink/pull/7026))
    - Added: support for HLS packed audio streams
    ([#7083](https://github.com/streamlink/streamlink/pull/7083),
    [#7082](https://github.com/streamlink/streamlink/pull/7082))
    - Added: `HLSSegment.{get,iter}_content()` and `HLSStreamWriter.{get,iter}_segment_content()` for being
    able to modify segment data ([#7059](https://github.com/streamlink/streamlink/pull/7059))
    - Added: `itsoffset` option to `FFMPEGMuxer` ([#7081](https://github.com/streamlink/streamlink/pull/7081))
    - Added: `nextjs_inline_rsc()` to `validate` API
    ([#7110](https://github.com/streamlink/streamlink/pull/7110))
    - Fixed: HTTP server of `--player-http`/`--player-continuous-http` binding to all interfaces
    ([#7051](https://github.com/streamlink/streamlink/pull/7051))
    - Fixed: zero or negative duration values in HLS dateranges
    ([#7074](https://github.com/streamlink/streamlink/pull/7074))
    - Fixed: incorrect `t` attribute evaluation in DASH `SegmentTimeline.S` nodes
    ([#7075](https://github.com/streamlink/streamlink/pull/7075))
    - Updated plugins:
      - ard_live: removed plugin ([#7091](https://github.com/streamlink/streamlink/pull/7091))
      - ard_mediathek: rewritten and fixed plugin
    ([#7090](https://github.com/streamlink/streamlink/pull/7090))
      - atresplayer: refactored stream retrieval ([#7062](https://github.com/streamlink/streamlink/pull/7062))
      - bigo: added MPEG-TS packet header decryption due to Bigo's web-protection
    ([#7056](https://github.com/streamlink/streamlink/pull/7056),
    [#7059](https://github.com/streamlink/streamlink/pull/7059))
      - bigo: worked around account requirements ([#7106](https://github.com/streamlink/streamlink/pull/7106),
    [#7109](https://github.com/streamlink/streamlink/pull/7109))
      - cdnbg: fixed player\_url schema ([#7036](https://github.com/streamlink/streamlink/pull/7036))
      - douyu: fixed API call failures on systems with unsynced clocks
    ([#7065](https://github.com/streamlink/streamlink/pull/7065))
      - filmon: updated URL matcher and switched to v2 APIs
    ([#7105](https://github.com/streamlink/streamlink/pull/7105))
      - goodgame: fixed stream retrieval ([#7086](https://github.com/streamlink/streamlink/pull/7086))
      - kick: fixed VODs ([#7108](https://github.com/streamlink/streamlink/pull/7108))
      - nimotv: fixed access to streams ([#7111](https://github.com/streamlink/streamlink/pull/7111))
      - okru: fixed metadata schema ([#7092](https://github.com/streamlink/streamlink/pull/7092))
      - piczel: removed plugin ([#7102](https://github.com/streamlink/streamlink/pull/7102))
      - pluto: fixed URL matcher, channel ID resolver and VODs
    ([#7048](https://github.com/streamlink/streamlink/pull/7048),
    [#7100](https://github.com/streamlink/streamlink/pull/7100))
      - tiktok: rewritten and fixed stream data schema for access to origin streams
    ([#7077](https://github.com/streamlink/streamlink/pull/7077))
      - twitch: added support for portrait-format streams
    ([#7087](https://github.com/streamlink/streamlink/pull/7087))
      - twitch: fixed missing category stream metadata breaking all stream metadata
    ([#7025](https://github.com/streamlink/streamlink/pull/7025))
      - vidio: rewritten and fixed plugin ([#7063](https://github.com/streamlink/streamlink/pull/7063))
      - zdf_mediathek: rewritten and fixed plugin
    ([#7093](https://github.com/streamlink/streamlink/pull/7093))
    - Dependencies: bumped min. version requirement of lxml to `5.0.0`
    ([#7029](https://github.com/streamlink/streamlink/pull/7029))

    [Full changelog](https://github.com/streamlink/streamlink/compare/8.5.0...8.6.0)


    ## streamlink 8.5.0 (2026-08-01)

    - Fixed: named-pipe player inputs not being cleaned up on pre-open failure
    ([#6935](https://github.com/streamlink/streamlink/pull/6935))
    - Fixed: stream start offsets being incorrectly cast to int in HLS
    ([#6941](https://github.com/streamlink/streamlink/pull/6941))
    - Fixed: `hls-playlist-reload-time` not accepting floats
    ([#6957](https://github.com/streamlink/streamlink/pull/6957))
    - Refactored: `HTTPSession` and fixed many typing issues
    ([#6924](https://github.com/streamlink/streamlink/pull/6924))
    - Refactored: `MPDNode` in DASH manifest parser to allow attribute namespaces
    ([#6988](https://github.com/streamlink/streamlink/pull/6988))
    - Updated plugins:
      - douyin: fixed validation schema ([#6930](https://github.com/streamlink/streamlink/pull/6930))
      - douyu: re-introduced plugin with new implementation
    ([#6959](https://github.com/streamlink/streamlink/pull/6959),
    [#7003](https://github.com/streamlink/streamlink/pull/7003))
      - mdstrm: added support for VODs / embedded streams with access tokens
    ([#6994](https://github.com/streamlink/streamlink/pull/6994))
      - nos: rewritten and fixed plugin ([#6954](https://github.com/streamlink/streamlink/pull/6954))
      - radiko: fixed live\_url value ([#6962](https://github.com/streamlink/streamlink/pull/6962))
      - trovo: removed plugin ([#6999](https://github.com/streamlink/streamlink/pull/6999))
      - tvazteca: added new plugin ([#6994](https://github.com/streamlink/streamlink/pull/6994))
    - Docs: clarified requirements of Twitch high quality streams
    ([#6992](https://github.com/streamlink/streamlink/pull/6992))
    - Tests: fixed test failures since Python 3.15 beta 1
    ([#6919](https://github.com/streamlink/streamlink/pull/6919))
    - Security: made GitHub releases immutable ([#6927](https://github.com/streamlink/streamlink/pull/6927))
    - Security: pinned all GitHub actions to commit IDs
    ([#6936](https://github.com/streamlink/streamlink/pull/6936))
    - Security: switched to uv lockfile for all CI workflows and for building release assets
    ([#6948](https://github.com/streamlink/streamlink/pull/6948))
    - Misc: added pre-built FISH shell completions to release tarballs and wheels
    ([#7014](https://github.com/streamlink/streamlink/pull/7014))

    [Full changelog](https://github.com/streamlink/streamlink/compare/8.4.0...8.5.0)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://bodhi.fedoraproject.org/updates/FEDORA-2026-d8cf5f20d7");
  script_set_attribute(attribute:"solution", value:
"Update the affected python-streamlink package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-92164");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/23");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/24");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/11/02");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:43");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:python-streamlink");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Fedora Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'Fedora' >!< os_product) audit(AUDIT_OS_NOT, 'Fedora');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'Fedora');
if (! preg(pattern:"^43([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'Fedora 43', 'Fedora ' + os_version);

if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Fedora', cpu);

var constraints = [
  {
    'release': '43',
    'pkgs': [
      {'reference':'python-streamlink-8.6.2-1.fc43', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'python-streamlink');
}