OpenSSL 3.5.0 < 3.5.8 Vulnerability

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(335167);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/13");

  script_cve_id("CVE-2026-14456");

  script_name(english:"OpenSSL 3.5.0 < 3.5.8 Vulnerability");

  script_set_attribute(attribute:"synopsis", value:
"The remote service is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of OpenSSL installed on the remote host is prior to 3.5.8. It is, therefore, affected by a vulnerability as
referenced in the 3.5.8 advisory.

  - Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for
    unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any
    limit. Impact summary: A remote peer that can make many Initial packets reach the server listener faster
    than the application accepts connections, can cause the memory allocated to store the per-channel state to
    grow without any limits, potentially making the QUIC listener unavailable and causing Denial of Service.
    CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: The function that handles
    inbound QUIC packets uses Connection-Id from the packet header to find an existing connection (QUIC
    channel). If no existing connection is found and the packet type is INITIAL, the function treats the
    packet as a new connection. It allocates a new channel object and inserts it into a queue where it waits
    to be accepted by the local application with SSL_accept(3ossl). The memory occupied by these initial
    channel objects may grow without bounds if the application is not able to call SSL_accept() frequently
    enough to serve these inbound connection requests. The issue is present since OpenSSL 3.5 when the QUIC
    server implementation was added. The fix introduces a limit for pending connections. The default limit is
    set to 256 pending connections (waiting to be accepted by the local application). Applications may change
    the default by calling SSL_set_value_uint(3ossl). FIPS impact: no The FIPS module is not affected as the
    QUIC implementation is outside of the OpenSSL FIPS module boundary. (CVE-2026-14456)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://openssl-library.org/news/secadv/20260813.txt");
  # https://openssl-library.org/policies/general/security-policy/index.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?eac4598c");
  script_set_attribute(attribute:"see_also", value:"https://www.cve.org/CVERecord?id=CVE-2026-14456");
  script_set_attribute(attribute:"solution", value:
"Upgrade to OpenSSL version 3.5.8 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-14456");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/13");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:openssl:openssl");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Web Servers");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("openssl_version.nasl", "openssl_nix_installed.nbin", "openssl_win_installed.nbin");
  script_require_keys("installed_sw/OpenSSL");

  exit(0);
}

include('vcf.inc');
include('vcf_extras_openssl.inc');

var app_info = vcf::combined_get_app_info(app:'OpenSSL');

vcf::check_all_backporting(app_info:app_info);

var constraints = [
  { 'min_version' : '3.5.0', 'fixed_version' : '3.5.8' }
];

vcf::openssl::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_WARNING
);