Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.3.1.6)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(303429);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/24");

  script_cve_id(
    "CVE-2025-15366",
    "CVE-2025-15367",
    "CVE-2025-48976",
    "CVE-2026-0865",
    "CVE-2026-1299"
  );

  script_name(english:"Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.3.1.6)");

  script_set_attribute(attribute:"synopsis", value:
"The Nutanix AOS host is affected by multiple vulnerabilities .");
  script_set_attribute(attribute:"description", value:
"The version of AOS installed on the remote host is prior to 7.3.1.6. It is, therefore, affected by multiple
vulnerabilities as referenced in the NXSA-AOS-7.3.1.6 advisory.

  - The email module, specifically the BytesGenerator class, didn't properly quote newlines for email
    headers when serializing an email message allowing for header injection when an email is serialized. This
    is only applicable if using LiteralHeader writing headers that don't respect email folding rules, the
    new behavior will reject the incorrectly folded headers in BytesGenerator. (CVE-2026-1299)

  - Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in
    Apache Commons FileUpload. This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from
    2.0.0-M1 before 2.0.0-M4. Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the
    issue. (CVE-2025-48976)

  - The imaplib module, when passed a user-controlled command, can have additional commands injected using
    newlines. Mitigation rejects commands containing control characters. (CVE-2025-15366)

  - The poplib module, when passed a user-controlled command, can have additional commands injected using
    newlines. Mitigation rejects commands containing control characters. (CVE-2025-15367)

  - User-controlled header names and values containing newlines can allow injecting HTTP headers.
    (CVE-2026-0865)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://portal.nutanix.com/page/documents/security-advisories/release-advisories/details?id=NXSA-AOS-7.3.1.6
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?67ae7ffb");
  script_set_attribute(attribute:"solution", value:
"Update the Nutanix AOS software to the recommended version. Before upgrading: if this cluster is registered with Prism
Central, ensure that Prism Central has been upgraded first to a compatible version. Refer to the Software Product
Interoperability page on the Nutanix portal.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-1299");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2025-48976");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/06/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/03/24");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/03/24");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:nutanix:aos");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("nutanix_collect.nasl");
  script_require_keys("Host/Nutanix/Data/lts", "Host/Nutanix/Data/Service", "Host/Nutanix/Data/Version", "Host/Nutanix/Data/arch");

  exit(0);
}

include('vcf.inc');
include('vcf_extras.inc');

var app_info = vcf::nutanix::get_app_info();

var constraints = [
  { 'fixed_version' : '7.3.1.6', 'equal' : '6.10', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '6.10.0.5', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '6.10.1', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '6.10.1.5', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '6.10.1.6', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '6.10.1.7', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '6.10.1.8', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '6.10.1.9', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '6.10.1.10', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '6.10.1.11', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '6.10.1.12', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '6.10.1.14', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '7.0', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '7.0.0.5', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '7.0.1', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '7.0.1.5', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '7.0.1.6', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '7.0.1.7', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '7.0.1.8', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '7.0.1.9', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '7.0.1.10', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '7.0.1.11', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '7.0.1.13', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '7.0.1.14', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '7.0.1.15', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '7.3', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '7.3.0.1', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '7.3.0.5', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '7.3.0.6', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '7.3.0.7', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '7.3.1', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '7.3.1.1', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '7.3.1.2', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '7.3.1.4', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '7.3.1.5', 'product' : 'AOS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '6.10', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '6.10.0.5', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '6.10.1', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '6.10.1.5', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '6.10.1.6', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '6.10.1.7', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '6.10.1.8', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '6.10.1.9', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '6.10.1.10', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '6.10.1.11', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '6.10.1.12', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '6.10.1.14', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '7.0', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '7.0.0.5', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '7.0.1', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '7.0.1.5', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '7.0.1.6', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '7.0.1.7', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '7.0.1.8', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '7.0.1.9', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '7.0.1.10', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '7.0.1.11', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '7.0.1.13', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '7.0.1.14', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '7.0.1.15', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '7.3', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '7.3.0.1', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '7.3.0.5', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '7.3.0.6', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '7.3.0.7', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '7.3.1', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '7.3.1.1', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '7.3.1.2', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '7.3.1.4', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' },
  { 'fixed_version' : '7.3.1.6', 'equal' : '7.3.1.5', 'product' : 'NDFS', 'fixed_display' : 'Upgrade the AOS install to 7.3.1.6 or higher.' }
];

vcf::nutanix::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_HOLE
);