Fedora 43 : cpp-httplib (2026-e76feaf213)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##
# The descriptive text and package checks in this plugin were
# extracted from Fedora Security Advisory FEDORA-2026-e76feaf213
#

include('compat.inc');

if (description)
{
  script_id(304453);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/31");

  script_cve_id("CVE-2026-32627");
  script_xref(name:"FEDORA", value:"2026-e76feaf213");

  script_name(english:"Fedora 43 : cpp-httplib (2026-e76feaf213)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Fedora host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the
FEDORA-2026-e76feaf213 advisory.

    # Update to 0.38.0 (rhbz#2447261)


    - Filename sanitization for path traversal prevention  Added sanitize_filename() to prevent path
    traversal attacks via malicious filenames in multipart uploads (83e98a2)
    - Symlink protection in static file server  Static file serving now detects and rejects symlinks that
    point outside the mount directory, preventing symlink-based directory traversal (f787f31)


    - Brotli compression support  Added Brotli (br) as a supported content encoding alongside gzip and
    deflate (ec1ffbc)
    - Accept-Encoding quality parameter parsing  The server now parses q= quality values in the Accept-
    Encoding header and selects the best encoding accordingly (bb7c7ab)
    - SSL proxy connection support  SSLClient can now establish connections through HTTPS proxies, with a
    new setup_proxy_connection method for cleaner proxy handling (f6ed5fc, b1bb2b7)
    - WebSocket ping interval runtime configuration  WebSocket ping interval can now be configured at
    runtime instead of only at compile time (257b266)


    - Benchmark test suite  Added benchmark tests and configurations for performance evaluation (ba0d0b8)
    - Unicode path component decoding tests  Added test coverage for Unicode characters in
    decode_path_component (43a54a3)
    - Documentation updates  Enhanced TLS backend documentation with platform-specific certificate handling
    details; clarified progress callback usage and user data handling in examples (511e3ef, 2e61fd3)


    - Fix port conflict in test  Fixed port number in OpenStreamMalformedContentLength test to avoid
    conflicts (4978f26)


    - Removed large data tests for GzipDecompressor and SSLClientServerTest that caused memory issues
    (5ecba74, 69d468f)
    - Enabled BindDualStack test (69d468f)

    Source: https://github.com/yhirose/cpp-httplib/releases/tag/v0.38.0


    - Fixes silent TLS certificate verification bypass on HTTPS Redirect via
    proxy ([CVE-2026-32627](https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-c3h8-fqq4-xm4g),
    rhbz#2448105)

    Source: https://github.com/yhirose/cpp-httplib/releases/tag/v0.37.2

    [//]: # (#2448104 NEW        - [email protected] - CVE-2026-32627 cpp-httplib: silent TLS certificate
    verification bypass on HTTPS Redirect via proxy [epel-all])
    [//]: # (#2448105 CLOSED     - [email protected] - CVE-2026-32627 cpp-httplib: silent TLS certificate
    verification bypass on HTTPS Redirect via proxy [fedora-all])
    [//]: # (#2447261 rebase)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://bodhi.fedoraproject.org/updates/FEDORA-2026-e76feaf213");
  script_set_attribute(attribute:"solution", value:
"Update the affected cpp-httplib package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-32627");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/03/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/03/23");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/03/31");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:43");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:cpp-httplib");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Fedora Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'Fedora' >!< os_product) audit(AUDIT_OS_NOT, 'Fedora');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'Fedora');
if (! preg(pattern:"^43([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'Fedora 43', 'Fedora ' + os_version);

if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Fedora', cpu);

var constraints = [
  {
    'release': '43',
    'pkgs': [
      {'reference':'cpp-httplib-0.38.0-1.fc43', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'cpp-httplib');
}