openSUSE 16 Security Update : trivy (openSUSE-SU-2026:21072-1)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The package checks in this plugin were extracted from
# openSUSE Security Update openSUSE-SU-2026:21072-1. The text itself
# is copyright (C) SUSE.
##

include('compat.inc');

if (description)
{
  script_id(324052);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/03");

  script_cve_id(
    "CVE-2026-44740",
    "CVE-2026-46680",
    "CVE-2026-47262",
    "CVE-2026-50195",
    "CVE-2026-53488",
    "CVE-2026-53489",
    "CVE-2026-53492"
  );

  script_name(english:"openSUSE 16 Security Update : trivy (openSUSE-SU-2026:21072-1)");

  script_set_attribute(attribute:"synopsis", value:
"The remote openSUSE host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the
openSUSE-SU-2026:21072-1 advisory.

    This update for trivy fixes the following issues

    Update to version 0.71.2:

    - CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to
    DoS via infinite
      loops, panics or resource consumption (bsc#1267268).
    - CVE-2026-46680: github.com/containerd/containerd/v2/pkg/oci: containerd user ID handling bypass allows
    runAsNonRoot
      evasion (bsc#1268356).
    - CVE-2026-47262: github.com/containerd/containerd/v2/pkg/oci: Denial of Service (DoS) condition via a
    maliciously
      crafted image (bsc#1268440).
    - CVE-2026-50195: containerd: fails to validate the image references specified within a checkpoint image's
      configuration (bsc#1268399).
    - CVE-2026-53488: containerd: CRI plugin propagates labels from an image config to a container without
    validation
      (bsc#1268400).
    - CVE-2026-53489: containerd: CRI plugin restores container.log from a checkpoint image without validating
    a symlinked
      path (bsc#1268404).
    - CVE-2026-53492: containerd: improperly trusts Container Device Interface (CDI) annotations found within
    untrusted
      checkpoint image metadata during container restoration (bsc#1268403).

    Changes for trivy:

     * release: v0.71.2 [release/v0.71] (#10871)
     * fix(deps): bump alpine to 3.24.1 [backport: release/v0.71] (#10870)
     * chore(deps): bump the common group with 4 updates [backport: release/v0.71] (#10867)
     * fix(oci): validate artifact filename
     * fix: forward ospkg detector options through ospkg.NewScanner
     * fix(vex): load VEX documents from within the repository
       directory
     * fix: surface the original analysis error instead of context
       cancellation
     * ci: expect GitHub App bot as backport PR author

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1267268");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1268356");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1268399");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1268400");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1268403");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1268404");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1268440");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-44740");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-46680");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-47262");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-50195");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-53488");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-53489");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-53492");
  script_set_attribute(attribute:"solution", value:
"Update the affected trivy package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-50195");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-53488");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/05/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/01");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:trivy");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:16.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"SuSE Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include('rpm.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/SuSE/release');
if (isnull(os_release) || os_release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, 'openSUSE');
var _os_ver = pregmatch(pattern: "^SUSE([\d.]+)", string:os_release);
if (isnull(_os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'openSUSE');
_os_ver = _os_ver[1];
if (os_release !~ "^(SUSE16\.0)$") audit(AUDIT_OS_RELEASE_NOT, 'openSUSE', '16.0', os_release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'openSUSE ' + _os_ver, cpu);

var pkgs = [
    {'reference':'trivy-0.71.2-160000.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var _cpu = NULL;
  var rpm_spec_vers_cmp = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (reference && _release) {
    if (rpm_check(release:_release, cpu:_cpu, reference:reference, rpm_spec_vers_cmp:rpm_spec_vers_cmp)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'trivy');
}