openSUSE 16 Security Update : go1.25-openssl (openSUSE-SU-2026:21696-1)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The package checks in this plugin were extracted from
# openSUSE Security Update openSUSE-SU-2026:21696-1. The text itself
# is copyright (C) SUSE.
##

include('compat.inc');

if (description)
{
  script_id(342104);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/01");

  script_cve_id(
    "CVE-2026-33818",
    "CVE-2026-39821",
    "CVE-2026-56853",
    "CVE-2026-56858",
    "CVE-2026-56859",
    "CVE-2026-56860",
    "CVE-2026-56862",
    "CVE-2026-56864",
    "CVE-2026-56865"
  );

  script_name(english:"openSUSE 16 Security Update : go1.25-openssl (openSUSE-SU-2026:21696-1)");

  script_set_attribute(attribute:"synopsis", value:
"The remote openSUSE host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the
openSUSE-SU-2026:21696-1 advisory.

    Update to version 1.25.14 cut from the go1.25-fips-release branch at the revision tagged
    go1.25.14-1-openssl-fips.

    Security issues fixed:

    - CVE-2026-33818: encoding/asn1: stack exhaustion when parsing deeply-nested, recursive structures can
    lead to denial
      of service (bsc#1275034).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for
    validation
      bypass and privilege escalation (bsc#1266609).
    - CVE-2026-56853: net/http: first header read timeout not being applied when a server is configured to
    support
      unencrypted HTTP/2 allows for denial of service (bsc#1275028).
    - CVE-2026-56858: html/template: wrong JavaScript regexp context tracking after top-level `{` can lead to
    XSS
      (bsc#1275033).
    - CVE-2026-56859: encoding/xml: stack exhaustion due to recursion depth guard bypass during decoding
    operations can
      lead to denial of service (bsc#1275026).
    - CVE-2026-56860: net/url: quadratic complexity in `resolvePath` when processing backtrack path elements
    can lead to
      denial of service (bsc#1275029).
    - CVE-2026-56862: crypto/tls: handshake messages can bypass non-advancing record limit in TLS 1.3, which
    can lead to
      a denial of service (bsc#1275032).
    - CVE-2026-56864: x/mod/sumdb: a malicious `GOSUMDB` is capable of serving arbitrary module content not
    contained
      within the transparency log (bsc#1275025).
    - CVE-2026-56865: x/mod/sumdb/tlog: a malicious `GOPROXY` is capable of forging sumdb tiles, which allows
    for bypass of
      the `GOSUMDB` check and persistence of attacker-controlled module contents to a local Go module cache
    (bsc#1275024).

    Other updates and bugfixes:

    - Update to version 1.25.14 cut from the go1.25-fips-release branch at the revision tagged
    go1.25.14-1-openssl-fips:
      (jsc#SLE-18320):
      * Rebase to 1.25.14
    - go1.25.14 (released 2026-08-19, boo#1244485):
      * go#80926 net/http: `ReadHeaderTimeout` remains active after unencrypted HTTP/2 handoff
    - go1.25.13 (released 2026-08-13):
      * includes security fixes to the `go` command, and the `crypto/tls`, `encoding/asn1`, `encoding/xml`,
    `html/template`,
        `net/http`, and `net/url` packages, as well as bug fixes to the compiler, the runtime, and the
    `crypto/tls` and `os`
        packages.
      * go#79876 cmd/compile: `prove` miscompilation in `slicemask` folding leaves garbage in the upper bits
      * go#80098 cmd/compile: internal compiler error invalid heap allocated var without `Heapaddr`
      * go#80364 os: `Root`'s `MkdirAll` can't create paths ending in forward slashes
      * go#80366 os: `TestRootMultiReadFile` fails on `netbsd/arm64` after CL 797880
      * go#80368 os: `TestRootConsistencyRemoveAll` fails on Plan 9 after CL 797880
      * go#80393 runtime: `arm64` found pointer to free object with safe code
      * go#80440 runtime: uninitialized register due to wrong ABI in `mach_vm_region_trampoline` leads to
    `libc` following
        garbage stack data as a pointer
      * go#80477 cmd/compile: `riscv64` miscompiles struct copy, corrupting a `[]byte` slice field
      * go#80500 runtime: js/wasm: found bad pointer in Go heap -- link-layout-constant value recorded as a
    pointer in the
        write-barrier buffer
      * go#80578 cmd/compile: `regalloc` uses unreliable type data (like `v.Type.IsSigned()`) to choose the
    restore of
        spills
      * go#80605 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement
      * go#80614 cmd/compile: `mips64le` miscompiles `OffPtr` by a const which doesn't fit 32bits resulting in
    panic
      * go#80616 cmd/compile: `mips`/`mips64`, multiply/divide results spilled from `HI`/`LO` corrupted w/ big
    stack frames
      * go#80618 cmd/compile: `prove` bug causes invalid indirect call
      * go#80737 runtime: `fpTracebackPartialExpand` `SIGSEGV` under high panic load
    - Update to version 1.25.12 cut from the go1.25-fips-release branch at the revision tagged
    go1.25.12-2-openssl-fips:
      * Limit openssl `RandReader` concurrency (#374)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1244485");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1266609");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1275024");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1275025");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1275026");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1275028");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1275029");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1275032");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1275033");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1275034");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-33818");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-39821");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-56853");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-56858");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-56859");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-56860");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-56862");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-56864");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-56865");
  script_set_attribute(attribute:"solution", value:
"Update the affected go1.25-openssl and / or go1.25-openssl-race packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-56858");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-56865");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/05/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/30");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/01");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:go1.25-openssl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:go1.25-openssl-race");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:16.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"SuSE Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include('rpm.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/SuSE/release');
if (isnull(os_release) || os_release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, 'openSUSE');
var _os_ver = pregmatch(pattern: "^SUSE([\d.]+)", string:os_release);
if (isnull(_os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'openSUSE');
_os_ver = _os_ver[1];
if (os_release !~ "^(SUSE16\.0)$") audit(AUDIT_OS_RELEASE_NOT, 'openSUSE', '16.0', os_release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'openSUSE ' + _os_ver, cpu);

var pkgs = [
    {'reference':'go1.25-openssl-1.25.14-160000.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'go1.25-openssl-race-1.25.14-160000.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var _cpu = NULL;
  var rpm_spec_vers_cmp = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (reference && _release) {
    if (rpm_check(release:_release, cpu:_cpu, reference:reference, rpm_spec_vers_cmp:rpm_spec_vers_cmp)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'go1.25-openssl / go1.25-openssl-race');
}