OpenSSL 4.0.0 < 4.0.4 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(378068);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/11/10");

  script_cve_id(
    "CVE-2026-88822",
    "CVE-2026-88823",
    "CVE-2026-95691",
    "CVE-2026-95692",
    "CVE-2026-107496"
  );

  script_name(english:"OpenSSL 4.0.0 < 4.0.4 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The remote service is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of OpenSSL installed on the remote host is prior to 4.0.4. It is, therefore, affected by multiple
vulnerabilities as referenced in the 4.0.4 advisory.

  - Issue summary: A retransmitted QUIC CRYPTO frame can release packet storage while the TLS record layer
    retains a direct pointer into that storage causing use after free.  Impact summary: A malicious QUIC
    server can cause a heap-use-after-free read in the OpenSSL QUIC client. The server can also identify one
    allocator-adjacent byte through the client's protected Handshake response.  CWE: CWE-416: Use After Free
    Description: During CRYPTO stream processing, a pointer into the first frame's memory on the stream is
    lent to the TLS handshake processing. The memory must remain stable until it is processed and released.
    However the processing of retransmitted CRYPTO frames could release the memory if the retransmitted frame
    fully overlapped the existing frame. This then causes use-after-free read when the TLS handshake
    processing continues.  The use-after-free read can lead to a Denial-of-Service of the client application
    or a minor leak of information about the heap memory contents that might be overwritten with other data,
    subsequently allocated by the application, to the peer.  FIPS impact: no The FIPS module is not affected
    as the QUIC implementation is outside of the OpenSSL FIPS module boundary. Fixed in OpenSSL 3.5.10
    (Affected since 3.5.0). (CVE-2026-95691)

  - Issue summary: Setting an AES-GCM-SIV IV shorter than the expected nonce length via EVP_CipherInit_ex()
    may trigger a heap out-of-bounds read. Supplying a longer IV is silently truncated instead of rejected.
    Impact summary: An application passing a caller-supplied IV of the wrong length may crash or read beyond
    its buffer. Because trailing IV bytes are ignored, an attacker who knows one message and tag may forge
    messages under a different IV.  CWE: CWE-125: Out-of-bounds Read  Description: AES-GCM-SIV copies the
    caller-supplied IV or nonce into its internal state using a copy whose length is taken from the expected
    nonce size rather than from the length the caller actually provided. When the caller passes a shorter IV,
    the copy reads past the end of the caller's buffer; AddressSanitizer confirms a heap out-of-bounds read
    reached through EVP_CipherInit_ex() into ossl_aes_gcm_siv_init(). When the caller passes a longer IV, the
    implementation silently discards the trailing bytes instead of rejecting the length.  The truncation
    breaks the binding between the IV and the computed authentication tag. An attacker who has observed a
    message and its tag under one IV can produce a message and tag that verify under a different IV whose
    first bytes match, since the surplus bytes never influence the computation. The message itself is
    unchanged, so this is a failure of IV commitment rather than a classic existential forgery.  Only
    applications that call EVP_CipherInit_ex() (or the equivalent provider cipher initialization) with an IV
    length other than the standard 12 bytes for AES-GCM-SIV are affected. The severity is limited because the
    out-of-bounds read is small and attacker-controlled only in length, and the forgery requires an unusual IV
    length choice by the application.  FIPS impact: no The FIPS modules are not affected by this issue, as
    AES-GCM-SIV is not an approved algorithm. Fixed in OpenSSL 3.5.10 (Affected since 3.5.0). (CVE-2026-95692)

  - Issue summary: QUIC, when performing automated peer detection, may allow uninitialized stack data to leak
    into the received address which is then used as the destination for outgoing packets.  Impact summary:
    Applications using QUIC's automated peer detection mechanism may receive an invalid address, leading to
    connection loss and disclosure of uninitialized stack data to an attacker observing the outgoing network
    traffic.  CWE: CWE-457 (Use of Uninitialized Variable)  Description: The OpenSSL QUIC stack contains a
    feature in which, when using an already connected socket, it will auto-detect the peer address during the
    SSL handshake.  This feature uses the getpeername() function, passing a buffer of sufficient length to
    hold any supported address family, but passes a buffer length that is only sized such that larger
    addresses, such as IPv6, cannot be retrieved. The getpeername() function however, still returns the full
    address length, which is accepted as the valid input buffer length, leading to the address buffer
    containing uninitialized stack data instead of the actual peer address. The invalid peer address is then
    used as destination for the outgoing packets which leads to a connectivity breakage and a leakage of the
    uninitialized stack data to passive network observers.  FIPS impact: no The FIPS modules in 4.0, 3.6, 3.5,
    3.4, and 3.0 are not affected by this CVE as the affected protocol is not implemented in the FIPS module.
    Fixed in OpenSSL 3.5.10 (Affected since 3.5.0). (CVE-2026-88822)

  - Issue summary: Encrypting a CMS message to an EC certificate whose group order is 1 may cause
    CMS_encrypt() or CMS_encrypt_ex() to loop indefinitely.  Impact summary: An attacker able to supply the
    recipient certificate to an application performing CMS encryption can cause that application to loop
    indefinitely, consuming CPU and resulting in Denial of Service.  CWE: CWE-835: Loop with Unreachable Exit
    Condition ('Infinite Loop')  Description: CMS_encrypt() and CMS_encrypt_ex() encrypt a message to one or
    more recipient certificates and, for an EC recipient, generate an ephemeral key in the recipient's group.
    If the certificate declares a group order of 1, random scalar generation can only produce zero. The key
    generation routine then retries without limit while waiting for a nonzero private scalar, so the call
    never returns.  The OpenSSL TLS and QUIC implementations do not use this path. An application is exposed
    only if it calls CMS_encrypt() or CMS_encrypt_ex() with a recipient certificate whose EC parameters are
    attacker-controlled. Certificates with normal EC group orders do not trigger the loop.  OpenSSL 4.0 and
    later reject unknown explicit EC groups in default builds. These versions are affected only when
    configured with the enable-ec_explicit_curves option.  The result is a hang that consumes a CPU core until
    the process is interrupted, a Denial of Service. The severity is Low because the attacker must supply the
    recipient certificate and the application must choose to encrypt to it; ordinary CMS encryption to trusted
    recipients is unaffected.  The fix makes EC key generation fail when the group has no valid nonzero
    private scalar, instead of retrying indefinitely.  FIPS impact: no The FIPS modules in 4.1, 4.0, 3.5 and
    3.0 are not affected. The FIPS provider does not support arbitrary explicit EC domain parameters, so an
    order-1 group is rejected during key import before the vulnerable key generation path is reached. Fixed in
    OpenSSL 1.0.2zt (Affected since 1.0.2). (CVE-2026-107496)

  - Issue summary: The AES-GCM-SIV implementation treats a zero-length Additional Authenticated Data (AAD)
    update as a reset of all the AAD supplied so far, instead of leaving the AAD unchanged. An application
    that supplies its AAD in several fragments, one of which is empty, therefore produces or verifies messages
    whose authentication tag does not cover the AAD supplied before the empty fragment.  Impact summary: Data
    an application intended to authenticate alongside a message is silently left unauthenticated. An attacker
    can forge the AAD of such a message.  CWE: CWE-325: Missing Cryptographic Step  Description: An
    application passing AAD in multiple chunks of which some have zero length will have the previous AAD
    chunks effectively unauthenticated. Also, on context re-initialisation, the AAD was not reset, which meant
    that any AAD accumulated from the previous context usage were also included in the AAD of the new message.
    The fix makes a zero-length AAD update a no-op and clears any accumulated AAD whenever the context is re-
    initialised with a key or a nonce. A re-initialisation that only changes parameters keeps the AAD.  FIPS
    impact: no The FIPS modules are not affected, as AES-GCM-SIV is not a FIPS approved algorithm and is
    implemented only in the default provider, outside the OpenSSL FIPS module boundary. Fixed in OpenSSL
    3.5.10 (Affected since 3.5.0). (CVE-2026-88823)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://github.com/openssl/openssl/commit/2f5fc833ff9b5bfe00b32f8b5c74f73c5773c682
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a83cbc06");
  # https://github.com/openssl/openssl/commit/510872388f5d145cf870868b3d288a23822cb776
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e7de8286");
  # https://github.com/openssl/openssl/commit/911eee8eb7550b95a206f1ad8cbdb986098982f3
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9c76bf93");
  # https://github.com/openssl/openssl/commit/a8531368ddb1f86d2a2782a8b693926bb67b59e7
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?973413dc");
  # https://github.com/openssl/openssl/commit/ec9d4de9d03989b29db5a3d7efdb4c285deaf386
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f9958b39");
  script_set_attribute(attribute:"see_also", value:"https://openssl-library.org/news/secadv/20261110.txt");
  # https://openssl-library.org/policies/general/security-policy/index.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?eac4598c");
  script_set_attribute(attribute:"see_also", value:"https://www.cve.org/CVERecord?id=CVE-2026-107496");
  script_set_attribute(attribute:"see_also", value:"https://www.cve.org/CVERecord?id=CVE-2026-88822");
  script_set_attribute(attribute:"see_also", value:"https://www.cve.org/CVERecord?id=CVE-2026-88823");
  script_set_attribute(attribute:"see_also", value:"https://www.cve.org/CVERecord?id=CVE-2026-95691");
  script_set_attribute(attribute:"see_also", value:"https://www.cve.org/CVERecord?id=CVE-2026-95692");
  script_set_attribute(attribute:"solution", value:
"Upgrade to OpenSSL version 4.0.4 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-95691");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/11/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/11/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/11/10");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:openssl:openssl");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Web Servers");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("openssl_version.nasl", "openssl_nix_installed.nbin", "openssl_win_installed.nbin");
  script_require_keys("installed_sw/OpenSSL");

  exit(0);
}

include('vcf.inc');
include('vcf_extras_openssl.inc');

var app_info = vcf::combined_get_app_info(app:'OpenSSL');

vcf::check_all_backporting(app_info:app_info);

var constraints = [
  { 'min_version' : '4.0.0', 'fixed_version' : '4.0.4' }
];

vcf::openssl::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_WARNING
);