Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-10.3.1.14)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(341614);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/31");

  script_cve_id(
    "CVE-2025-6170",
    "CVE-2025-13151",
    "CVE-2026-5435",
    "CVE-2026-5450",
    "CVE-2026-5928",
    "CVE-2026-6238",
    "CVE-2026-15308",
    "CVE-2026-28390",
    "CVE-2026-33416",
    "CVE-2026-41411",
    "CVE-2026-44431",
    "CVE-2026-48864",
    "CVE-2026-58016"
  );

  script_name(english:"Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-10.3.1.14)");

  script_set_attribute(attribute:"synopsis", value:
"The Nutanix AHV host is affected by multiple vulnerabilities .");
  script_set_attribute(attribute:"description", value:
"The version of AHV installed on the remote host is prior to 10.3.1.14. It is, therefore, affected by multiple
vulnerabilities as referenced in the NXSA-AHV-10.3.1.14 advisory.

  - A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the
    gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a
    `node` element nested within other elements like `method`, `signal`, `property` or `arg`. This issue can
    cause an unsigned integer overflow and lead to an out-of-bounds read, resulting in a denial of service.
    (CVE-2026-58016)

  - urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed
    from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still
    forward these sensitive headers. This vulnerability is fixed in 2.7.0. (CVE-2026-44431)

  - A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files.
    When a user inputs an overly long command, the program does not check the input size properly, which can
    cause it to crash. This issue might allow attackers to run harmful code in rare configurations without
    modern protections. (CVE-2025-6170)

  - A flaw was found in libsolv. This heap buffer overflow occurs during the decompression of attacker-
    controlled compressed data within `.solv` files due to insufficient input validation. An attacker can
    provide a specially crafted `.solv` file, which, when processed by a vulnerable application, can lead to
    out-of-bounds memory access. This could result in information disclosure, alteration of program execution,
    or a denial of service. (CVE-2026-48864)

  - Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a
    NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS
    data may crash before authentication or cryptographic operations occur resulting in Denial of Service.
    When a CMS EnvelopedData message that uses KeyTransportRecipientInfo with RSA-OAEP encryption is
    processed, the optional parameters field of RSA-OAEP SourceFunc algorithm identifier is examined without
    checking for its presence. This results in a NULL pointer dereference if the field is missing.
    Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based
    protocols) are vulnerable. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,
    as the affected code is outside the OpenSSL FIPS module boundary. (CVE-2026-28390)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://portal.nutanix.com/page/documents/security-advisories/release-advisories/details?id=NXSA-AHV-10.3.1.14
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?71a2c22c");
  script_set_attribute(attribute:"solution", value:
"Update the Nutanix AHV software to the recommended version. Before upgrading: if this cluster is registered with Prism
Central, ensure that Prism Central has been upgraded first to a compatible version. Refer to the Software Product
Interoperability page on the Nutanix portal.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-58016");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-15308");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/04/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/31");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/31");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:nutanix:ahv");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("nutanix_collect.nasl");
  script_require_keys("Host/Nutanix/Data/Node/Version", "Host/Nutanix/Data/Node/Type");

  exit(0);
}

include('vcf.inc');
include('vcf_extras.inc');

var app_info = vcf::nutanix::get_app_info(node:TRUE);

var constraints = [
  { 'min_version' : '10.0', 'fixed_version' : '10.3.1.14', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to 10.3.1.14 or higher.' },
  { 'fixed_version' : '10.3.1.14', 'equal' : '20230302.102001', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to 10.3.1.14 or higher.' },
  { 'fixed_version' : '10.3.1.14', 'equal' : '20230302.102005', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to 10.3.1.14 or higher.' },
  { 'fixed_version' : '10.3.1.14', 'equal' : '20230302.103003', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to 10.3.1.14 or higher.' },
  { 'fixed_version' : '10.3.1.14', 'equal' : '20230302.103014', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to 10.3.1.14 or higher.' },
  { 'fixed_version' : '10.3.1.14', 'equal' : '20230302.103032', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to 10.3.1.14 or higher.' },
  { 'fixed_version' : '10.3.1.14', 'equal' : '20230302.103053', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to 10.3.1.14 or higher.' },
  { 'fixed_version' : '10.3.1.14', 'equal' : '20230302.103068', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to 10.3.1.14 or higher.' },
  { 'fixed_version' : '10.3.1.14', 'equal' : '20230302.103072', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to 10.3.1.14 or higher.' },
  { 'fixed_version' : '10.3.1.14', 'equal' : '20230302.103084', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to 10.3.1.14 or higher.' },
  { 'fixed_version' : '10.3.1.14', 'equal' : '20230302.103087', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to 10.3.1.14 or higher.' },
  { 'fixed_version' : '10.3.1.14', 'equal' : '20230302.103100', 'product' : 'AHV', 'fixed_display' : 'Upgrade the AHV install to 10.3.1.14 or higher.' }
];

vcf::nutanix::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_HOLE
);