openSUSE 16 Security Update : go1.26-openssl (openSUSE-SU-2026:21705-1)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The package checks in this plugin were extracted from
# openSUSE Security Update openSUSE-SU-2026:21705-1. The text itself
# is copyright (C) SUSE.
##

include('compat.inc');

if (description)
{
  script_id(342115);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/01");

  script_cve_id(
    "CVE-2026-33818",
    "CVE-2026-39821",
    "CVE-2026-56853",
    "CVE-2026-56858",
    "CVE-2026-56859",
    "CVE-2026-56860",
    "CVE-2026-56862",
    "CVE-2026-56864",
    "CVE-2026-56865"
  );

  script_name(english:"openSUSE 16 Security Update : go1.26-openssl (openSUSE-SU-2026:21705-1)");

  script_set_attribute(attribute:"synopsis", value:
"The remote openSUSE host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the
openSUSE-SU-2026:21705-1 advisory.

    Update to version 1.26.7 cut from the go1.25-fips-release branch at the revision tagged
    go1.26.7-1-openssl-fips.

    Security issues fixed:

    - CVE-2026-33818: encoding/asn1: stack exhaustion when parsing deeply-nested, recursive structures can
    lead to denial
      of service (bsc#1275034).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for
    validation
      bypass and privilege escalation (bsc#1266609).
    - CVE-2026-56853: net/http: first header read timeout not being applied when a server is configured to
    support
      unencrypted HTTP/2 allows for denial of service (bsc#1275028).
    - CVE-2026-56858: html/template: wrong JavaScript regexp context tracking after top-level `{` can lead to
    XSS
      (bsc#1275033).
    - CVE-2026-56859: encoding/xml: stack exhaustion due to recursion depth guard bypass during decoding
    operations can
      lead to denial of service (bsc#1275026).
    - CVE-2026-56860: net/url: quadratic complexity in `resolvePath` when processing backtrack path elements
    can lead to
      denial of service (bsc#1275029).
    - CVE-2026-56862: crypto/tls: handshake messages can bypass non-advancing record limit in TLS 1.3, which
    can lead to
      a denial of service (bsc#1275032).
    - CVE-2026-56864: x/mod/sumdb: a malicious `GOSUMDB` is capable of serving arbitrary module content not
    contained
      within the transparency log (bsc#1275025).
    - CVE-2026-56865: x/mod/sumdb/tlog: a malicious `GOPROXY` is capable of forging sumdb tiles, which allows
    for bypass of
      the `GOSUMDB` check and persistence of attacker-controlled module contents to a local Go module cache
    (bsc#1275024).

    Other updates and bugfixes:

    - Update to version 1.26.7 cut from the go1.25-fips-release branch at the revision tagged
    go1.26.7-1-openssl-fips:
      (jsc#SLE-18320).
      * Rebase to 1.26.7
      * Support `strictfipsruntime` with `no_openssl`
      * Fix multiple `no_openssl` build tag issues
    - go1.26.7 (released 2026-08-19, boo#1255111):
      * go#80927 net/http: `ReadHeaderTimeout` remains active after unencrypted `HTTP/2` handoff
    - go1.26.6 (released 2026-08-13):
      * includes security fixes to the `go` command, and the `crypto/tls`, `encoding/asn1`, `encoding/xml`,
        `html/template`, `net`, `net/http`, and `net/url` packages, as well as bug fixes to the compiler, the
    linker, the
        runtime, and the `crypto/tls` and `os` packages.
      * go#79876 cmd/compile: `prove` misscompilation in `slicemask` folding leaves garbage in the upper bits
      * go#80099 cmd/compile: internal compiler error invalid heap allocated var without `Heapaddr`
      * go#80131 cmd/link: `peCreateExportFile` generates invalid `.def` file when output name has trailing
    dot (`c-shared`
        on Windows)
      * go#80365 os: `Root`'s `MkdirAll` can't create paths ending in forward slashes
      * go#80367 os: `TestRootMultiReadFile` fails on `netbsd/arm64` after CL 797880
      * go#80369 os: `TestRootConsistencyRemoveAll` fails on Plan 9 after CL 797880
      * go#80394 runtime: `arm64` found pointer to free object with safe code
      * go#80441 runtime: uninitialized register due to wrong ABI in `mach_vm_region_trampoline` leads to
    `libc` following
        garbage stack data as a pointer
      * go#80478 cmd/compile: `riscv64` miscompiles struct copy, corrupting a `[]byte` slice field
      * go#80499 runtime: js/wasm: found bad pointer in Go heap -- link-layout-constant value recorded as a
    pointer in
        the write-barrier buffer
      * go#80579 cmd/compile: `regalloc` uses unreliable type data (like `v.Type.IsSigned()`) to choose the
    restore of
        spills
      * go#80606 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement
      * go#80609 net, x/net/dns/dnsmessage: panic when parsing invalid `SVCB` record
      * go#80615 cmd/compile: `mips64le` misscompile `OffPtr` by a const which doesn't fit 32bits resulting in
    panic
      * go#80617 cmd/compile: `mips`/`mips64`, multiply/divide results spilled from `HI`/`LO` corrupted w/ big
    stack frames
      * go#80619 cmd/compile: `prove` bug causes invalid indirect call
      * go#80715 runtime: `fpTracebackPartialExpand` `SIGSEGV` under high panic load
    - Update to version 1.26.5 cut from the go1.25-fips-release branch at the revision tagged
    go1.26.5-2-openssl-fips:
      * Limit `openssl` `RandReader` concurrency

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1255111");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1266609");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1275024");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1275025");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1275026");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1275028");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1275029");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1275032");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1275033");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1275034");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-33818");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-39821");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-56853");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-56858");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-56859");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-56860");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-56862");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-56864");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-56865");
  script_set_attribute(attribute:"solution", value:
"Update the affected go1.26-openssl and / or go1.26-openssl-race packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-56858");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-56865");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/05/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/30");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/01");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:go1.26-openssl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:go1.26-openssl-race");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:16.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"SuSE Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include('rpm.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/SuSE/release');
if (isnull(os_release) || os_release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, 'openSUSE');
var _os_ver = pregmatch(pattern: "^SUSE([\d.]+)", string:os_release);
if (isnull(_os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'openSUSE');
_os_ver = _os_ver[1];
if (os_release !~ "^(SUSE16\.0)$") audit(AUDIT_OS_RELEASE_NOT, 'openSUSE', '16.0', os_release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'openSUSE ' + _os_ver, cpu);

var pkgs = [
    {'reference':'go1.26-openssl-1.26.7-160000.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'go1.26-openssl-race-1.26.7-160000.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var _cpu = NULL;
  var rpm_spec_vers_cmp = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (reference && _release) {
    if (rpm_check(release:_release, cpu:_cpu, reference:reference, rpm_spec_vers_cmp:rpm_spec_vers_cmp)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'go1.26-openssl / go1.26-openssl-race');
}