TencentOS Server 3: curl (TSSA-2023:0172)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Tencent Linux Security Advisory TSSA-2023:0172.
##

include('compat.inc');

if (description)
{
  script_id(276313);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/11/20");

  script_cve_id("CVE-2023-27536", "CVE-2023-28321");
  script_xref(name:"IAVA", value:"2023-A-0153-S");
  script_xref(name:"IAVA", value:"2023-A-0259-S");

  script_name(english:"TencentOS Server 3: curl (TSSA-2023:0172)");

  script_set_attribute(attribute:"synopsis", value:
"The remote TencentOS Server 3 host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is,
therefore, affected by multiple vulnerabilities as referenced in the TSSA-2023:0172 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

      CVE-2023-27536:
      An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can
    reuse previously established connections with incorrect user permissions due to a failure to check for
    changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI
    transfers and could potentially result in unauthorized access to sensitive information. The safest option
    is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed.

      CVE-2023-28321:
      An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching
    of wildcard patterns when listed as Subject Alternative Name in TLS server certificates. curl can be
    built to use its own name matching function for TLS rather than one provided by a TLS library. This
    private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could
    as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code
    before used for certificate checks. Puny coded names always start with xn-- and should not be allowed to
    pattern match, but the wildcard check in curl could still check for x*, which would match even though the
    IDN name most likely contained nothing even resembling an x.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://mirrors.tencent.com/tlinux/errata/tssa-20230172.xml");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:N/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-28321");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/03/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2023/09/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/11/20");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:tencent:tencentos_server:3");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:tencent:tencentos_server:curl");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tencent Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/etc/os-release", "Host/TencentOS/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'TencentOS' >!< os_product) audit(AUDIT_OS_NOT, 'TencentOS');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'TencentOS');
if (! preg(pattern:"^3([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'TencentOS 3.x', 'TencentOS ' + os_version);

if (!get_kb_item('Host/TencentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'TencentOS', cpu);

var constraints = [
  {
    'release': '3',
    'pkgs': [
      {'reference':'curl-7.61.1-30.tl3.3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'curl-7.61.1-30.tl3.3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'curl-debuginfo-7.61.1-30.tl3.3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'curl-debuginfo-7.61.1-30.tl3.3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'curl-debugsource-7.61.1-30.tl3.3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'curl-debugsource-7.61.1-30.tl3.3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'curl-minimal-debuginfo-7.61.1-30.tl3.3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'curl-minimal-debuginfo-7.61.1-30.tl3.3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libcurl-7.61.1-30.tl3.3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libcurl-7.61.1-30.tl3.3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libcurl-debuginfo-7.61.1-30.tl3.3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libcurl-debuginfo-7.61.1-30.tl3.3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libcurl-devel-7.61.1-30.tl3.3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libcurl-devel-7.61.1-30.tl3.3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libcurl-minimal-7.61.1-30.tl3.3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libcurl-minimal-7.61.1-30.tl3.3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libcurl-minimal-debuginfo-7.61.1-30.tl3.3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libcurl-minimal-debuginfo-7.61.1-30.tl3.3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'curl / curl-debuginfo / curl-debugsource / etc');
}