TencentOS Server 4: git (TSSA-2025:0532)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Tencent Linux Security Advisory TSSA-2025:0532.
##

include('compat.inc');

if (description)
{
  script_id(253461);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/12/17");

  script_cve_id("CVE-2025-48384", "CVE-2025-48385", "CVE-2025-48386");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2025/09/15");

  script_name(english:"TencentOS Server 4: git (TSSA-2025:0532)");

  script_set_attribute(attribute:"synopsis", value:
"The remote TencentOS Server 4 host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is,
therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0532 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-48386:
    Git is a fast, scalable, distributed revision control system with an unusually rich command set that
    provides both high-level operations and full access to internals. The wincred credential helper uses a
    static buffer (target) as a unique key for storing and comparing against internal storage. This credential
    helper does not properly bounds check the available space remaining in the buffer before appending to it
    with wcsncat(), leading to potential buffer overflows. This vulnerability is fixed in v2.43.7, v2.44.4,
    v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.

    CVE-2025-48385:
    Git is a fast, scalable, distributed revision control system with an unusually rich command set that
    provides both high-level operations and full access to internals. When cloning a repository Git knows to
    optionally fetch a bundle advertised by the remote server, which allows the server-side to offload parts
    of the clone to a CDN. The Git client does not perform sufficient validation of the advertised bundles,
    which allows the remote side to perform protocol injection. This protocol injection can cause the client
    to write the fetched bundle to a location controlled by the adversary. The fetched content is fully
    controlled by the server, which can in the worst case lead to arbitrary code execution. The use of bundle
    URIs is not enabled by default and can be controlled by the bundle.heuristic config option. Some cases of
    the vulnerability require that the adversary is in control of where a repository will be cloned to. This
    either requires social engineering or a recursive clone with submodules. These cases can thus be avoided
    by disabling recursive clones. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3,
    v2.48.2, v2.49.1, and v2.50.1.

    CVE-2025-48384:
    Git is a fast, scalable, distributed revision control system with an unusually rich command set that
    provides both high-level operations and full access to internals. When reading a config value, Git strips
    any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR
    are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if
    the submodule path contains a trailing CR, the altered path is read resulting in the submodule being
    checked out to an incorrect location. If a symlink exists that points the altered path to the submodule
    hooks directory, and the submodule contains an executable post-checkout hook, the script may be
    unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4,
    v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://mirrors.tencent.com/tlinux/errata/tssa-20250532.xml");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:A");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-48385");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2025-48384");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/08/18");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/08/18");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/08/21");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:tencent:tencentos_server:4");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:tencent:tencentos_server:git");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tencent Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/etc/os-release", "Host/TencentOS/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'TencentOS' >!< os_product) audit(AUDIT_OS_NOT, 'TencentOS');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'TencentOS');
if (! preg(pattern:"^4([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'TencentOS 4.x', 'TencentOS ' + os_version);

if (!get_kb_item('Host/TencentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'TencentOS', cpu);

var constraints = [
  {
    'release': '4',
    'pkgs': [
      {'reference':'git-2.41.3-2.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'git-2.41.3-2.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'git-all-2.41.3-2.tl4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'git-core-2.41.3-2.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'git-core-2.41.3-2.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'git-core-debuginfo-2.41.3-2.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'git-core-debuginfo-2.41.3-2.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'git-core-doc-2.41.3-2.tl4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'git-credential-libsecret-2.41.3-2.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'git-credential-libsecret-2.41.3-2.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'git-credential-libsecret-debuginfo-2.41.3-2.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'git-credential-libsecret-debuginfo-2.41.3-2.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'git-daemon-2.41.3-2.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'git-daemon-2.41.3-2.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'git-daemon-debuginfo-2.41.3-2.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'git-daemon-debuginfo-2.41.3-2.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'git-debugsource-2.41.3-2.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'git-debugsource-2.41.3-2.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'git-email-2.41.3-2.tl4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'git-gui-2.41.3-2.tl4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'git-instaweb-2.41.3-2.tl4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'git-p4-2.41.3-2.tl4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'git-subtree-2.41.3-2.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'git-subtree-2.41.3-2.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'gitk-2.41.3-2.tl4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'gitweb-2.41.3-2.tl4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'perl-Git-2.41.3-2.tl4', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'git / git-all / git-core / etc');
}