Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-10.3.1)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(269975);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/15");

  script_cve_id(
    "CVE-2016-9840",
    "CVE-2019-17543",
    "CVE-2023-40403",
    "CVE-2024-12718",
    "CVE-2024-23337",
    "CVE-2024-28956",
    "CVE-2024-34397",
    "CVE-2024-43420",
    "CVE-2024-45332",
    "CVE-2024-47081",
    "CVE-2024-52533",
    "CVE-2024-54661",
    "CVE-2025-3576",
    "CVE-2025-4138",
    "CVE-2025-4330",
    "CVE-2025-4373",
    "CVE-2025-4435",
    "CVE-2025-4517",
    "CVE-2025-4802",
    "CVE-2025-5994",
    "CVE-2025-6020",
    "CVE-2025-6021",
    "CVE-2025-6965",
    "CVE-2025-7425",
    "CVE-2025-8058",
    "CVE-2025-20012",
    "CVE-2025-20623",
    "CVE-2025-24495",
    "CVE-2025-32414",
    "CVE-2025-32415",
    "CVE-2025-32462",
    "CVE-2025-40909",
    "CVE-2025-47273",
    "CVE-2025-48060",
    "CVE-2025-49794",
    "CVE-2025-49796"
  );

  script_name(english:"Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-10.3.1)");

  script_set_attribute(attribute:"synopsis", value:
"The Nutanix AHV host is affected by multiple vulnerabilities .");
  script_set_attribute(attribute:"description", value:
"The version of AHV installed on the remote host is prior to 10.3.1 / AHV-10.3.1. It is, therefore, affected by multiple
vulnerabilities as referenced in the NXSA-AHV-10.3.1 advisory.

  - LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize),
    affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data
    corruption.) NOTE: the vendor states only a few specific / uncommon usages of the API are at risk.
    (CVE-2019-17543)

  - setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python
    packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to version
    78.1.1. An attacker would be allowed to write files to arbitrary locations on the filesystem with the
    permissions of the process running the Python code, which could escalate to remote code execution
    depending on the context. Version 78.1.1 fixes the issue. (CVE-2025-47273)

  - A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under
    certain circumstances when the XML schematron has the <sch:name path=.../> schema elements. This flaw
    allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the
    program's crash using libxml or other possible undefined behaviors. (CVE-2025-49794)

  - A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can
    trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that
    can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to
    sensitive data being corrupted in memory. (CVE-2025-49796)

  - A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations
    can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of
    service when processing crafted input. (CVE-2025-6021)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://portal.nutanix.com/page/documents/security-advisories/release-advisories/details?id=NXSA-AHV-10.3.1
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d9066dfe");
  script_set_attribute(attribute:"solution", value:
"Update the Nutanix AHV software to the recommended version. Before upgrading: if this cluster is registered with Prism
Central, ensure that Prism Central has been upgraded first to a compatible version. Refer to the Software Product
Interoperability page on the Nutanix portal.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_supplemental", value:"CVSS:4.0/R:U/V:C");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-17543");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2025-6965");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2025-5994");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2016/12/04");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/10/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/10/10");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:nutanix:ahv");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("nutanix_collect.nasl");
  script_require_keys("Host/Nutanix/Data/Node/Version", "Host/Nutanix/Data/Node/Type");

  exit(0);
}

include('vcf.inc');
include('vcf_extras.inc');

var app_info = vcf::nutanix::get_app_info(node:TRUE);

var constraints = [
  { 'min_version' : '10.0', 'fixed_version' : '10.3.1', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-10.3.1 or higher.' },
  { 'fixed_version' : 'AHV-10.3.1', 'equal' : '20230302.102001', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-10.3.1 or higher.' },
  { 'fixed_version' : 'AHV-10.3.1', 'equal' : '20230302.102005', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-10.3.1 or higher.' },
  { 'fixed_version' : 'AHV-10.3.1', 'equal' : '20230302.103003', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-10.3.1 or higher.' },
  { 'fixed_version' : 'AHV-10.3.1', 'equal' : '20230302.103014', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-10.3.1 or higher.' },
  { 'fixed_version' : 'AHV-10.3.1', 'equal' : '20230302.103032', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-10.3.1 or higher.' },
  { 'fixed_version' : 'AHV-10.3.1', 'equal' : '20230302.103053', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-10.3.1 or higher.' },
  { 'fixed_version' : 'AHV-10.3.1', 'equal' : '20230302.103068', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-10.3.1 or higher.' },
  { 'fixed_version' : 'AHV-10.3.1', 'equal' : '20230302.103072', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to AHV-10.3.1 or higher.' }
];

vcf::nutanix::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_WARNING
);