TencentOS Server 4: jetty (TSSA-2025:0390)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Tencent Linux Security Advisory TSSA-2025:0390.
##

include('compat.inc');

if (description)
{
  script_id(241484);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/12/04");

  script_cve_id(
    "CVE-2022-2048",
    "CVE-2023-36478",
    "CVE-2024-13009",
    "CVE-2024-22201"
  );

  script_name(english:"TencentOS Server 4: jetty (TSSA-2025:0390)");

  script_set_attribute(attribute:"synopsis", value:
"The remote TencentOS Server 4 host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is,
therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0390 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-13009:
    In Eclipse Jetty versions 9.4.0 to 9.4.56 a buffer can be incorrectly released when confronted with a gzip
    error when inflating a request
    body. This can result in corrupted and/or inadvertent sharing of data between requests.

    CVE-2024-22201:
    Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP
    congested will be leaked when it times out. An attacker can cause many connections to end up in this
    state, and the server may run out of file descriptors, eventually causing the server to stop accepting new
    connections from valid clients. The vulnerability is patched in 9.4.54, 10.0.20, 11.0.20, and 12.0.6.

    CVE-2023-36478:
    Eclipse Jetty provides a web server and servlet container. In versions 11.0.0 through 11.0.15, 10.0.0
    through 10.0.15, and 9.0.0 through 9.4.52, an integer overflow in `MetaDataBuilder.checkSize` allows for
    HTTP/2 HPACK header values to
    exceed their size limit. `MetaDataBuilder.java` determines if a header name or value exceeds the size
    limit, and throws an exception if the limit is exceeded. However, when length is very large and huffman is
    true, the multiplication by 4 in line 295
    will overflow, and length will become negative. `(_size+length)` will now be negative, and the check on
    line 296 will not be triggered. Furthermore, `MetaDataBuilder.checkSize` allows for user-entered HPACK
    header value sizes to be negative, potentially leading to a very large buffer allocation later on when the
    user-entered size is multiplied by 2. This means that if a user provides a negative length value (or, more
    precisely, a length value which, when multiplied by the 4/3 fudge factor, is negative), and this length
    value is a very large positive number when multiplied by 2, then the user can cause a very large buffer to
    be allocated on the server. Users of HTTP/2 can be impacted by a remote denial of service attack. The
    issue has been fixed in versions 11.0.16, 10.0.16, and 9.4.53. There are no known workarounds.

    CVE-2022-2048:
    In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error
    handling has a bug that can wind up not properly cleaning up the active connections and associated
    resources. This can lead to a Denial of Service scenario where there are no enough resources left to
    process good requests.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://mirrors.tencent.com/tlinux/errata/tssa-20250390.xml");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-2048");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2024-22201");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/06/23");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/06/23");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/07/07");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:tencent:tencentos_server:4");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:tencent:tencentos_server:jetty");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tencent Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/etc/os-release", "Host/TencentOS/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'TencentOS' >!< os_product) audit(AUDIT_OS_NOT, 'TencentOS');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'TencentOS');
if (! preg(pattern:"^4([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'TencentOS 4.x', 'TencentOS ' + os_version);

if (!get_kb_item('Host/TencentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'TencentOS', cpu);

var constraints = [
  {
    'release': '4',
    'pkgs': [
      {'reference':'jetty-9.4.40-6.tl4.3', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'jetty-client-9.4.40-6.tl4.3', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'jetty-continuation-9.4.40-6.tl4.3', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'jetty-http-9.4.40-6.tl4.3', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'jetty-io-9.4.40-6.tl4.3', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'jetty-jaas-9.4.40-6.tl4.3', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'jetty-javadoc-9.4.40-6.tl4.3', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'jetty-jmx-9.4.40-6.tl4.3', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'jetty-security-9.4.40-6.tl4.3', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'jetty-server-9.4.40-6.tl4.3', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'jetty-servlet-9.4.40-6.tl4.3', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'jetty-util-9.4.40-6.tl4.3', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'jetty-util-ajax-9.4.40-6.tl4.3', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'jetty-webapp-9.4.40-6.tl4.3', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'jetty-xml-9.4.40-6.tl4.3', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'jetty / jetty-client / jetty-continuation / etc');
}