openSUSE 16: tomcat / tomcat-admin-webapps / tomcat-el-3_0-api / tomcat-embed / etc (openSUSE-SU-2026:21486-1)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The package checks in this plugin were extracted from
# openSUSE Security Update openSUSE-SU-2026:21486-1. The text itself
# is copyright (C) SUSE.
##

include('compat.inc');

if (description)
{
  script_id(331553);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/01");

  script_cve_id("CVE-2026-59083", "CVE-2026-59084");
  script_xref(name:"IAVA", value:"2026-A-0709");

  script_name(english:"openSUSE 16: tomcat / tomcat-admin-webapps / tomcat-el-3_0-api / tomcat-embed / etc (openSUSE-SU-2026:21486-1)");

  script_set_attribute(attribute:"synopsis", value:
"The remote openSUSE host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the
openSUSE-SU-2026:21486-1 advisory.

    Update to Tomcat 9.0.120.

    Security issues fixed:

    - CVE-2026-59083: incorrect URL decoding in `RewriteValve` may allow security control bypass
    (bsc#1271397).
    - CVE-2026-59084: `EncryptInterceptor` requirements are not clearly documented (bsc#1271398).

    Other updates and bugfixes:

    - Tomcat 9.0.120:
      * Catalina
        - Fix: Avoid a race condition with concurrent lookups for a singleton JNDI
          resource. (markt)
        - Fix: Improve the performance of range validation for the default
          servlet. (markt)
        - Fix: Avoid NPE in RewriteValve. (markt)
        - Fix: 70127: Fix use of Bootstrap through reflection by restoring the
          public constructor. Use through scripts was not affected. (remm)
        - Fix: Restore ability to extend many element classes from
          AbstractAccessLogValve. (remm)
        - Fix: Align DIGEST authentication with RFC 7616 and require clients to
          provide a valid qop parameter. (markt)
        - Fix: Use Files API to create temporary docBase when antiLockingDocBase
          is enabled. (markt)
        - Fix: Improve validation of configuration when DataSourceRealm starts.
          (remm)
        - Fix: JAASRealm should do a logout if login does not fail outright but
          does not produce a Principal. (remm)
        - Fix: Various edge cases for SSI substitutions, quoting and escaping.
        - Fix: unintentional conversion of literal + to a space during rule
          processing in the RewriteValve. (markt)
      * Coyote
        - Fix: Avoid a potential JVM crash if a suitable version of Tomcat Native
          is not available when the connector is explicitly configured to use
          Tomcat Native with OpenSSL for TLS. (markt)
        - Fix: Correct a regression introduced in 9.0.119 that broke reading of
          some request bodies via a Reader. (markt)
      * Jasper
        - Fix: 70120: The fix for 69399 (itself a fix for a regression in the fix
          for 69333) was incomplete and tags that threw exceptions in doStartTag()
          and doEndTag() were incorrectly re-used. This fix prevents tags from
          being re-used if such an exception occurs. (markt)
        - Fix: 70135: Fix security classload regression. (remm)
        - Add: support for specifying Java 28 (with the value 28) as the compiler
          source and/or compiler target for JSP compilation. If used with an
          Eclipse JDT compiler version that does not support these values, a
          warning will be logged and the default will be used. (markt)
      * WebSocket
        - Fix: 70126: Fix WebSocket extension permessage-deflate so that it does
          not drop bytes if a compressed message inflates to more than the
          available buffer. Fix written by GPT-5.5. Test case written by Hironori
          Ichimiya. (markt)
        - Fix: Optimise WebSocket client processing of server responses during
          WebSocket HTTP upgrade process. (markt)
      * Other
        - Update: Byte Buddy to 1.18.9. (markt)
        - Update: UnboundID to 7.0.5. (markt)
        - Update: JaCoCo to 0.8.15. (markt)
        - Update: BND to 7.3.0. (markt)
        - Add: Improvements to French translations. (remm)
        - Add: Improvements to Japanese translations provided by tak7iji. (markt)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1271397");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1271398");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-59083");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-59084");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-59084");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/30");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/01");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:tomcat");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:tomcat-admin-webapps");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:tomcat-el-3_0-api");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:tomcat-embed");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:tomcat-javadoc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:tomcat-jsp-2_3-api");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:tomcat-jsvc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:tomcat-lib");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:tomcat-servlet-4_0-api");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:tomcat-webapps");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:16.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"SuSE Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include('rpm.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/SuSE/release');
if (isnull(os_release) || os_release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, 'openSUSE');
var _os_ver = pregmatch(pattern: "^SUSE([\d.]+)", string:os_release);
if (isnull(_os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'openSUSE');
_os_ver = _os_ver[1];
if (os_release !~ "^(SUSE16\.0)$") audit(AUDIT_OS_RELEASE_NOT, 'openSUSE', '16.0', os_release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'openSUSE ' + _os_ver, cpu);

var pkgs = [
    {'reference':'tomcat-9.0.120-160000.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'tomcat-admin-webapps-9.0.120-160000.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'tomcat-el-3_0-api-9.0.120-160000.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'tomcat-embed-9.0.120-160000.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'tomcat-javadoc-9.0.120-160000.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'tomcat-jsp-2_3-api-9.0.120-160000.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'tomcat-jsvc-9.0.120-160000.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'tomcat-lib-9.0.120-160000.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'tomcat-servlet-4_0-api-9.0.120-160000.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'tomcat-webapps-9.0.120-160000.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var _cpu = NULL;
  var rpm_spec_vers_cmp = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (reference && _release) {
    if (rpm_check(release:_release, cpu:_cpu, reference:reference, rpm_spec_vers_cmp:rpm_spec_vers_cmp)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'tomcat / tomcat-admin-webapps / tomcat-el-3_0-api / tomcat-embed / etc');
}