openSUSE 16 Security Update : cheat (openSUSE-SU-2025:20177-1)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The package checks in this plugin were extracted from
# openSUSE Security Update openSUSE-SU-2025:20177-1. The text itself
# is copyright (C) SUSE.
##

include('compat.inc');

if (description)
{
  script_id(279664);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/12/24");

  script_cve_id(
    "CVE-2023-48795",
    "CVE-2025-21613",
    "CVE-2025-21614",
    "CVE-2025-22869",
    "CVE-2025-22870",
    "CVE-2025-47913",
    "CVE-2025-47914",
    "CVE-2025-58181"
  );

  script_name(english:"openSUSE 16 Security Update : cheat (openSUSE-SU-2025:20177-1)");

  script_set_attribute(attribute:"synopsis", value:
"The remote openSUSE host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the
openSUSE-SU-2025:20177-1 advisory.

    - Security:
      * CVE-2025-47913: Fix client process termination (bsc#1253593)
      * CVE-2025-58181: Fix potential unbounded memory consumption (bsc#1253922)
      * CVE-2025-47914: Fix panic due to an out of bounds read (bsc#1254051)
      * Replace golang.org/x/crypto=golang.org/x/[email protected]
      * Replace golang.org/x/net=golang.org/x/[email protected]
      * Replace golang.org/x/sys=golang.org/x/[email protected]

    - Packaging improvements:
      * Drop Requires: golang-packaging. The recommended Go toolchain
        dependency expression is BuildRequires: golang(API) >= 1.x or
        optionally the metapackage BuildRequires: go
      * Use BuildRequires: golang(API) >= 1.19 matching go.mod
      * Build PIE with pattern that may become recommended procedure:
        %%ifnarch ppc64 GOFLAGS=-buildmode=pie %%endif go build
        A go toolchain buildmode default config would be preferable
        but none exist at this time.
      * Drop mod=vendor, go1.14+ will detect vendor dir and auto-enable
      * Remove go build -o output binary location and name. Default
        binary has the same name as package of func main() and is
        placed in the top level of the build directory.
      * Add basic %check to execute binary --help

    - Packaging improvements:
      * Service go_modules replace dependencies with CVEs
      * Replace github.com/cloudflare/circl=github.com/cloudflare/[email protected]
        Fix GO-2025-3754 GHSA-2x5j-vhc8-9cwm
      * Replace golang.org/x/net=golang.org/x/[email protected]
        Fixes GO-2025-3503 CVE-2025-22870
      * Replace golang.org/x/crypto=golang.org/x/[email protected]
        Fixes GO-2023-2402 CVE-2023-48795 GHSA-45x7-px36-x8w8
        Fixes GO-2025-3487 CVE-2025-22869
      * Replace github.com/go-git/go-git/v5=github.com/go-git/go-git/[email protected]
        Fixes GO-2025-3367 CVE-2025-21614 GHSA-r9px-m959-cxf4
        Fixes GO-2025-3368 CVE-2025-21613 GHSA-v725-9546-7q7m
      * Service tar_scm set mode manual from disabled
      * Service tar_scm create archive from git so we can exclude
        vendor directory upstream committed to git. Committed vendor
        directory contents have build issues even after go mod tidy.
      * Service tar_scm exclude dir vendor
      * Service set_version set mode manual from disabled
      * Service set_version remove param basename not needed

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1247629");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1253593");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1253922");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1254051");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2023-48795");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2025-21613");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2025-21614");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2025-22869");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2025-22870");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2025-47913");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2025-47914");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2025-58181");
  script_set_attribute(attribute:"solution", value:
"Update the affected cheat package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:N/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_supplemental", value:"CVSS:4.0/AU:N/R:A/V:D/RE:L/U:Amber");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-48795");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/06/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/12/18");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/12/24");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:cheat");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:16.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"SuSE Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include('rpm.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/SuSE/release');
if (isnull(os_release) || os_release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, 'openSUSE');
var _os_ver = pregmatch(pattern: "^SUSE([\d.]+)", string:os_release);
if (isnull(_os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'openSUSE');
_os_ver = _os_ver[1];
if (os_release !~ "^(SUSE16\.0)$") audit(AUDIT_OS_RELEASE_NOT, 'openSUSE', '16.0', os_release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'openSUSE ' + _os_ver, cpu);

var pkgs = [
    {'reference':'cheat-4.4.2-bp160.2.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var _cpu = NULL;
  var rpm_spec_vers_cmp = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (reference && _release) {
    if (rpm_check(release:_release, cpu:_cpu, reference:reference, rpm_spec_vers_cmp:rpm_spec_vers_cmp)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'cheat');
}