OpenSSL 4.0.0 < 4.0.3 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(352189);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/30");

  script_cve_id(
    "CVE-2026-35189",
    "CVE-2026-35191",
    "CVE-2026-42772",
    "CVE-2026-54872",
    "CVE-2026-54873",
    "CVE-2026-54875",
    "CVE-2026-72897",
    "CVE-2026-75804",
    "CVE-2026-75805",
    "CVE-2026-75806",
    "CVE-2026-77696",
    "CVE-2026-84782",
    "CVE-2026-84783",
    "CVE-2026-84784"
  );

  script_name(english:"OpenSSL 4.0.0 < 4.0.3 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The remote service is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of OpenSSL installed on the remote host is prior to 4.0.3. It is, therefore, affected by multiple
vulnerabilities as referenced in the 4.0.3 advisory.

  - Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is
    suspended part-way through. The retransmitted message can be read past the message buffer and the
    retransmission overwrites the internal state the suspended write needs to resume correctly. Impact
    summary: The retransmitted message can disclose a heap memory to the peer as plaintext handshake data or
    cause a crash and a Denial of Service when the read reaches an unmapped memory region. CWE: CWE-125: Out-
    of-bounds Read Description: DTLS handshake messages can be written out in multiple fragments, and a write
    can suspend mid-message (returning WANT_WRITE) if the underlying transport temporarily cannot accept more
    data. While such a write is suspended, the DTLS retransmission timer may independently fire and ask the
    retransmission logic to resend an earlier, already-acknowledged-as-sent message from its retransmit queue.
    The retransmission logic reused the same internal buffer and position tracking as the message that was
    still being written, without resetting the position back to the start of the message being retransmitted.
    As a result the retransmission was read starting from wherever the suspended write had left off, producing
    a mislabelled message whose body was leftover bytes from the other, larger message still in flight -
    content that was never meant to be sent at that point, and which could run past the end of the allocated
    buffer. Separately, even when the retransmission is positioned correctly, allowing it to run to completion
    while another write is suspended overwrites the same shared bookkeeping that the suspended write depends
    on to resume. When the application later resumes the suspended write (via a subsequent SSL_read(),
    SSL_write(), SSL_accept(), or SSL_connect() call), it finds that bookkeeping in a state inconsistent with
    the message and aborts the process in a debugging build. The fix resets the retransmission's read position
    to the start of the message before resending, and skips retransmission entirely whenever a handshake write
    is still suspended, deferring to the next call that resumes it instead. FIPS impact: no The affected code
    is outside the FIPS module boundary. (CVE-2026-84782)

  - Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes
    disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted
    certificate from a malicious peer can lead to significant memory pressure and possible Denial of Service
    in clients or in servers that solicit client certificates. CWE: CWE-770: Allocation of Resources Without
    Limits or Throttling Description: A certificate or a set of certificates that fits under the limit for
    size of certificates accepted from the peer (~100 KiB) can result in allocation of several hundred MiB of
    resident memory on the receiving side during a normal TLS handshake. This may be enough to crash the
    client or server, if multiple concurrent connections lead to similarly large memory allocations. The fix
    postpones processing of the CRL distribution points extensions in certificates to the time when the
    processed value is required for CRL processing. This avoids keeping large memory allocations for a long
    time when such certificates are received. FIPS impact: no The affected code is outside the FIPS module
    boundary. (CVE-2026-35189)

  - Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced
    to count incoming packets multiple times in its unvalidated credit computation, leading to a violation of
    the RFC 9000 unvalidated connection amplification limit of 3 times the amount of data received. Impact
    summary: A remote attacker able to spoof packets to a server using the OpenSSL QUIC implementation might
    use the server for an amplification of a DDoS attack. CWE: CWE-440: Expected Behavior Violation
    Description: OpenSSL's QUIC stack, when operating as a server, enforces client address validation (RFC
    9000, Section 8), to confirm the peer address is not used for a traffic amplification attack. If this
    feature is disabled on the server, the QUIC stack limits the amount of server data that can be sent to 3
    times the amount of data received from the peer address, until such time as the TLS handshake is
    completed. The OpenSSL QUIC server, when operating in non-validation mode, adds the length of the whole
    datagram received to the unvalidated credit limit when processing each QUIC packet in the datagram. A
    remote peer may, after establishing a connection with an initial client hello frame, send a subsequent
    datagram containing multiple QUIC packets, leading the server to account the entire datagram length for
    each packet in the datagram, resulting in the server believing that the peer has sent more data than it
    actually has, thereby violating the 3x amplification limit mandated by the RFC. FIPS impact: no As the
    QUIC stack lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.
    (CVE-2026-35191)

  - Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are
    arriving out of order. The worst case has a quadratic complexity proportional to the number of stream
    frames kept in the buffer for the received stream data. Impact summary: A remote QUIC peer that completes
    the handshake can create a connection-scoped CPU pressure and potentially a Denial of Service using
    compliant STREAM frames inside the advertised receive window, with low attacker bandwidth. CWE: CWE-407:
    Inefficient Algorithmic Complexity Description: OpenSSL manages received QUIC stream fragments using a
    doubly-linked list. While it optimizes for append operations (at the end of the list), it falls back to a
    head-to-tail linear search for any fragment that does not immediately follow the current `tail`. By
    manipulating the sequence of offsets, an attacker can force the server to perform O(n^2) operations,
    consuming excessive CPU time for the QUIC process. FIPS impact: no The FIPS module is not affected as the
    QUIC implementation is outside of the OpenSSL FIPS module boundary. (CVE-2026-42772)

  - Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature
    operations with curves that do not have a dedicated implementation leaks information about the secret
    nonce through timing. Impact summary: An attacker able to measure signing times may learn information
    about the per-signature secret nonce, which over many signatures can, via a lattice / Hidden Number
    Problem attack, lead to recovery of the private key. CWE: CWE-208: Observable Timing Discrepancy
    Description: The generic elliptic-curve scalar multiplication used for curves that do not have a dedicated
    constant-time implementation pads the secret scalar with non-constant-time BIGNUM operations, so the time
    taken depends on the value of the secret scalar derived from the ECDSA and SM2 nonce. The leak is very
    small; observing it requires a large number of measurements. The effect is largest for curves whose group
    order lies on a machine-word boundary, such as brainpoolP384r1. Applications using ECDSA signing over the
    Brainpool and other generic prime curves, and SM2 signing on platforms that use the generic
    implementation, are vulnerable to this issue. The NIST curves P-256, P-384 and P-521 use dedicated
    constant-time implementations and are not affected. FIPS Impact: no The FIPS modules are not affected: the
    approved NIST curves used in the FIPS provider have dedicated constant-time implementations and do not use
    the affected code path. (CVE-2026-54872)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://github.com/openssl/openssl/commit/04728a289a823e68137f88da016cb9ede307217d
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3082b17d");
  # https://github.com/openssl/openssl/commit/1f643b8bc735487b500a1f68a7fb3a22d5e38e23
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3f657dd7");
  # https://github.com/openssl/openssl/commit/20b20628d39b2dcc4677194bd68c7c060fa598cb
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?94cd861f");
  # https://github.com/openssl/openssl/commit/2b93c73b2c70ddc4c61c5e4bfaaa6bd71379eb84
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e44d63cb");
  # https://github.com/openssl/openssl/commit/64d3102fb5b54311e92517f26ba00169d719e74a
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?fe87c4d9");
  # https://github.com/openssl/openssl/commit/7ca0ccb5172a577e9b87267d77bfe21e5481a5e7
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b0bf76e3");
  # https://github.com/openssl/openssl/commit/8166827a78aad164a07aa86dea2b425403ced471
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?378de67f");
  # https://github.com/openssl/openssl/commit/9794ed473764839275cb701b4850f3c24d929c28
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0f73345d");
  # https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?52dc3511");
  # https://github.com/openssl/openssl/commit/de97a1a54f43edefd43b5084ecac54ecadb33081
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?59a8eb1b");
  # https://github.com/openssl/openssl/commit/e44292e58b090014232ef75bd400393851b24d1a
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0687685c");
  # https://github.com/openssl/openssl/commit/e87ed26b298a74d8ba61a53e9c7bcd1acac6b814
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c68ffd59");
  # https://github.com/openssl/openssl/commit/e9e5155833fa968bee50024bf9ca3a185ab599fe
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f5d70538");
  # https://github.com/openssl/openssl/commit/f42ae513bbda513b3c121d54834040ee4a0eae1a
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?76b4c27e");
  script_set_attribute(attribute:"see_also", value:"https://openssl-library.org/news/secadv/20260929.txt");
  # https://openssl-library.org/policies/general/security-policy/index.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?eac4598c");
  script_set_attribute(attribute:"see_also", value:"https://www.cve.org/CVERecord?id=CVE-2026-35189");
  script_set_attribute(attribute:"see_also", value:"https://www.cve.org/CVERecord?id=CVE-2026-35191");
  script_set_attribute(attribute:"see_also", value:"https://www.cve.org/CVERecord?id=CVE-2026-42772");
  script_set_attribute(attribute:"see_also", value:"https://www.cve.org/CVERecord?id=CVE-2026-54872");
  script_set_attribute(attribute:"see_also", value:"https://www.cve.org/CVERecord?id=CVE-2026-54873");
  script_set_attribute(attribute:"see_also", value:"https://www.cve.org/CVERecord?id=CVE-2026-54875");
  script_set_attribute(attribute:"see_also", value:"https://www.cve.org/CVERecord?id=CVE-2026-72897");
  script_set_attribute(attribute:"see_also", value:"https://www.cve.org/CVERecord?id=CVE-2026-75804");
  script_set_attribute(attribute:"see_also", value:"https://www.cve.org/CVERecord?id=CVE-2026-75805");
  script_set_attribute(attribute:"see_also", value:"https://www.cve.org/CVERecord?id=CVE-2026-75806");
  script_set_attribute(attribute:"see_also", value:"https://www.cve.org/CVERecord?id=CVE-2026-77696");
  script_set_attribute(attribute:"see_also", value:"https://www.cve.org/CVERecord?id=CVE-2026-84782");
  script_set_attribute(attribute:"see_also", value:"https://www.cve.org/CVERecord?id=CVE-2026-84783");
  script_set_attribute(attribute:"see_also", value:"https://www.cve.org/CVERecord?id=CVE-2026-84784");
  script_set_attribute(attribute:"solution", value:
"Upgrade to OpenSSL version 4.0.3 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-84782");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/29");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/29");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/30");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:openssl:openssl");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Web Servers");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("openssl_version.nasl", "openssl_nix_installed.nbin", "openssl_win_installed.nbin");
  script_require_keys("installed_sw/OpenSSL");

  exit(0);
}

include('vcf.inc');
include('vcf_extras_openssl.inc');

var app_info = vcf::combined_get_app_info(app:'OpenSSL');

vcf::check_all_backporting(app_info:app_info);

var constraints = [
  { 'min_version' : '4.0.0', 'fixed_version' : '4.0.3' }
];

vcf::openssl::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_HOLE
);