The remote Redhat Enterprise Linux 9 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.
golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)
Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a ‘/’ character can result in unexpectedly closing the CSS context and allowing for injection of unexpected HTML, if executed with untrusted input. (CVE-2023-24539)
Templates containing actions in unquoted HTML attributes (e.g. attr={{.}}) executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags. (CVE-2023-29400)
Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <= 8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three certificates in circulation with keys larger than this, and all three appear to be test certificates that are not actively deployed. It is possible there are larger keys in use in private PKIs, but we target the web PKI, so causing breakage here in the interests of increasing the default safety of users of crypto/tls seems reasonable. (CVE-2023-29409)
The html/template package does not properly handle HTML-like comment tokens, nor hashbang #! comment tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of <script> contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS attack. (CVE-2023-39318)
The html/template package does not apply the proper rules for handling occurrences of <script,
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Red Hat Security Advisory golang. The text
# itself is copyright (C) Red Hat, Inc.
##
include('compat.inc');
if (description)
{
script_id(195845);
script_version("1.0");
script_set_attribute(attribute:"plugin_modification_date", value:"2024/05/11");
script_cve_id(
"CVE-2023-24539",
"CVE-2023-24540",
"CVE-2023-29400",
"CVE-2023-29409",
"CVE-2023-39318",
"CVE-2023-39319",
"CVE-2023-39321",
"CVE-2023-39322",
"CVE-2023-39326",
"CVE-2023-45287"
);
script_name(english:"RHEL 9 : golang (Unpatched Vulnerability)");
script_set_attribute(attribute:"synopsis", value:
"The remote Red Hat 9 host is affected by multiple vulnerabilities that will not be patched.");
script_set_attribute(attribute:"description", value:
"The remote Redhat Enterprise Linux 9 host has one or more packages installed that are affected by multiple
vulnerabilities that have been acknowledged by the vendor but will not be patched.
- golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)
- Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates
containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS
context and allowing for injection of unexpected HTML, if executed with untrusted input. (CVE-2023-24539)
- Templates containing actions in unquoted HTML attributes (e.g. attr={{.}}) executed with empty input can
result in output with unexpected results when parsed due to HTML normalization rules. This may allow
injection of arbitrary attributes into tags. (CVE-2023-29400)
- Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time
verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <=
8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three certificates in
circulation with keys larger than this, and all three appear to be test certificates that are not actively
deployed. It is possible there are larger keys in use in private PKIs, but we target the web PKI, so
causing breakage here in the interests of increasing the default safety of users of crypto/tls seems
reasonable. (CVE-2023-29409)
- The html/template package does not properly handle HTML-like comment tokens, nor hashbang #! comment
tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of
<script> contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS
attack. (CVE-2023-39318)
- The html/template package does not apply the proper rules for handling occurrences of <script, <!--,
and </script within JS literals in <script> contexts. This may cause the template parser to improperly
consider script contexts to be terminated early, causing actions to be improperly escaped. This could be
leveraged to perform an XSS attack. (CVE-2023-39319)
- Processing an incomplete post-handshake message for a QUIC connection can cause a panic. (CVE-2023-39321)
- QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake
messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now
consistently reject messages larger than 65KiB in size. (CVE-2023-39322)
- A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response
body to read many more bytes from the network than are in the body. A malicious HTTP client can further
exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a
handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which
permit including additional metadata in a request or response body sent using the chunked encoding. The
net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large
metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real
body to encoded bytes grows too small. (CVE-2023-39326)
- Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA
blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective.
In particular it appears as if the removal of PKCS#1 padding may leak timing information, which in turn
could be used to recover session key bits. In Go 1.20, the crypto/tls library switched to a fully constant
time RSA implementation, which we do not believe exhibits any timing side channels. (CVE-2023-45287)
Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package
is installed.");
script_set_attribute(attribute:"solution", value:
"The vendor has acknowledged the vulnerabilities but no solution has been provided. Refer to the vendor for remediation
guidance.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-24540");
script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
script_set_attribute(attribute:"exploit_available", value:"false");
script_set_attribute(attribute:"vendor_unpatched", value:"true");
script_set_attribute(attribute:"vuln_publication_date", value:"2023/05/04");
script_set_attribute(attribute:"plugin_publication_date", value:"2024/05/11");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:8");
script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:9");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:butane");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:conmon");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:containernetworking-plugins");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:git-lfs");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:grafana");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:grafana-pcp");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:ignition");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:osbuild-composer");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:redhat-certification-cnf");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:redhat-certification-preflight");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:skopeo");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:toolbox");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:weldr-client");
script_set_attribute(attribute:"generated_plugin", value:"current");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Red Hat Local Security Checks");
script_copyright(english:"This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("ssh_get_info.nasl", "redhat_repos.nasl");
script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
exit(0);
}
include('rpm.inc');
include('rhel.inc');
if (!get_kb_item("global_settings/vendor_unpatched"))
exit(0, "Unpatched Vulnerabilities Detection not active.");
if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/RedHat/release');
if (isnull(os_release) || 'Red Hat' >!< os_release) audit(AUDIT_OS_NOT, 'Red Hat');
var os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:os_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');
os_ver = os_ver[1];
if (!rhel_check_release(operator: 'ge', os_version: os_ver, rhel_version: '9')) audit(AUDIT_OS_NOT, 'Red Hat 9.x', 'Red Hat ' + os_ver);
if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu && 'ppc' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);
var constraints = [
{
'pkgs': [
{'reference':'butane', 'release':'9', 'rpm_spec_vers_cmp':TRUE, 'unpatched_pkg':'butane', 'cves':['CVE-2023-39321']},
{'reference':'conmon', 'release':'9', 'rpm_spec_vers_cmp':TRUE, 'unpatched_pkg':'conmon', 'cves':['CVE-2023-39321']},
{'reference':'git-lfs', 'release':'9', 'rpm_spec_vers_cmp':TRUE, 'unpatched_pkg':'git-lfs', 'cves':['CVE-2023-39321']},
{'reference':'grafana', 'release':'9', 'rpm_spec_vers_cmp':TRUE, 'unpatched_pkg':'grafana', 'cves':['CVE-2023-39318', 'CVE-2023-39319', 'CVE-2023-39321', 'CVE-2023-39322', 'CVE-2023-45287']},
{'reference':'grafana-pcp', 'release':'9', 'rpm_spec_vers_cmp':TRUE, 'unpatched_pkg':'grafana-pcp', 'cves':['CVE-2023-39319', 'CVE-2023-39321', 'CVE-2023-39322', 'CVE-2023-45287']},
{'reference':'ignition', 'release':'9', 'rpm_spec_vers_cmp':TRUE, 'unpatched_pkg':'ignition', 'cves':['CVE-2023-29400', 'CVE-2023-39319', 'CVE-2023-39321', 'CVE-2023-39322']},
{'reference':'osbuild-composer', 'release':'9', 'rpm_spec_vers_cmp':TRUE, 'unpatched_pkg':'osbuild-composer', 'cves':['CVE-2023-24539', 'CVE-2023-24540', 'CVE-2023-29400']},
{'reference':'redhat-certification-cnf', 'release':'9', 'rpm_spec_vers_cmp':TRUE, 'unpatched_pkg':'redhat-certification-cnf', 'cves':['CVE-2023-29409']},
{'reference':'redhat-certification-preflight', 'release':'9', 'rpm_spec_vers_cmp':TRUE, 'unpatched_pkg':'redhat-certification-preflight', 'cves':['CVE-2023-29409']},
{'reference':'toolbox', 'release':'9', 'rpm_spec_vers_cmp':TRUE, 'unpatched_pkg':'toolbox', 'cves':['CVE-2023-39321', 'CVE-2023-39322']},
{'reference':'weldr-client', 'release':'9', 'rpm_spec_vers_cmp':TRUE, 'unpatched_pkg':'weldr-client', 'cves':['CVE-2023-39326']}
]
}
];
var flag = 0;
foreach var constraint_array ( constraints ) {
var repo_relative_urls = NULL;
var enterprise_linux_flag = rhel_repo_urls_has_content_dist_rhel(repo_urls:repo_relative_urls);
foreach var pkg ( constraint_array['pkgs'] ) {
var unpatched_pkg = NULL;
var _release = NULL;
var sp = NULL;
var el_string = NULL;
var rpm_spec_vers_cmp = NULL;
var exists_check = NULL;
var cves = NULL;
if (!empty_or_null(pkg['unpatched_pkg'])) unpatched_pkg = pkg['unpatched_pkg'];
if (!empty_or_null(pkg['release'])) _release = 'RHEL' + pkg['release'];
if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
if (unpatched_pkg &&
_release &&
(!exists_check || rpm_exists(release:_release, rpm:exists_check)) &&
unpatched_package_exists(release:_release, package:unpatched_pkg, cves: cves)) flag++;
}
}
if (flag)
{
var extra = NULL;
security_report_v4(
port : 0,
severity : SECURITY_HOLE,
extra : unpatched_packages_report()
);
exit(0);
}
else
{
var tested = pkg_tests_get();
if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'butane / conmon / git-lfs / grafana / grafana-pcp / ignition / etc');
}
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24539
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24540
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29400
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29409
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39318
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39319
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39321
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39322
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39326
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45287