TencentOS Server 3: git (TSSA-2025:0995)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Tencent Linux Security Advisory TSSA-2025:0995.
##

include('compat.inc');

if (description)
{
  script_id(284640);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/14");

  script_cve_id(
    "CVE-2024-50349",
    "CVE-2024-52006",
    "CVE-2025-27613",
    "CVE-2025-27614",
    "CVE-2025-46835",
    "CVE-2025-48384",
    "CVE-2025-48385"
  );
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2025/09/15");

  script_name(english:"TencentOS Server 3: git (TSSA-2025:0995)");

  script_set_attribute(attribute:"synopsis", value:
"The remote TencentOS Server 3 host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is,
therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0995 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2024-50349:
    Git is a fast, scalable, distributed revision control system with an unusually rich command set that
    provides both high-level operations and full access to internals. When Git asks for credentials via a
    terminal prompt (i.e. without using any credential helper), it prints out the host name for which the user
    is expected to provide a username and/or a password. At this stage, any URL-encoded parts have been
    decoded already, and are printed verbatim. This allows attackers to craft URLs that contain ANSI escape
    sequences that the terminal interpret to confuse users e.g. into providing passwords for trusted Git
    hosting sites when in fact they are then sent to untrusted sites that are under the attacker's control.
    This issue has been patch via commits 7725b81 and c903985 which are included in release versions v2.48.1,
    v2.47.2, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to upgrade.
    Users unable to upgrade should avoid cloning from untrusted URLs, especially recursive clones.

    CVE-2024-52006:
    Git is a fast, scalable, distributed revision control system with an unusually rich command set that
    provides both high-level operations and full access to internals. Git defines a line-based protocol that
    is used to exchange information between Git and Git credential helpers. Some ecosystems (most notably,
    .NET and node.js) interpret single Carriage Return characters as newlines, which renders the protections
    against CVE-2020-5260 incomplete for credential helpers that treat Carriage Returns in this way. This
    issue has been addressed in commit b01b9b8 which is included in release versions v2.48.1, v2.47.2,
    v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to upgrade. Users
    unable to upgrade should avoid cloning from untrusted URLs, especially recursive clones.

    CVE-2025-27613:
    Gitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted
    repository and runs gitk without additional command arguments, files for which the user has write
    permission can be created and truncated. The option Support per-file encoding must have been enabled
    before in Gitk's Preferences. This option is disabled by default. The same happens when Show origin of
    this line is used in the main window (regardless of whether Support per-file encoding is enabled or not).
    This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.

    CVE-2025-27614:
    Gitk is a Tcl/Tk based Git history browser. Starting with 2.41.0, a Git repository can be crafted in such
    a way that with some social engineering a user who has cloned the repository can be tricked into running
    any script (e.g., Bourne shell, Perl, Python, ...) supplied by the attacker by invoking gitk filename,
    where filename has a particular structure. The script is run with the privileges of the user. This
    vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.

    CVE-2025-46835:
    Git GUI allows you to use the Git source control management tools via a GUI. When a user clones an
    untrusted repository and is tricked into editing a file located in a maliciously named directory in the
    repository, then Git GUI can create and overwrite files for which the user has write permission. This
    vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.

    CVE-2025-48384:
    Git is a fast, scalable, distributed revision control system with an unusually rich command set that
    provides both high-level operations and full access to internals. When reading a config value, Git strips
    any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR
    are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if
    the submodule path contains a trailing CR, the altered path is read resulting in the submodule being
    checked out to an incorrect location. If a symlink exists that points the altered path to the submodule
    hooks directory, and the submodule contains an executable post-checkout hook, the script may be
    unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4,
    v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.

    CVE-2025-48385:
    Git is a fast, scalable, distributed revision control system with an unusually rich command set that
    provides both high-level operations and full access to internals. When cloning a repository Git knows to
    optionally fetch a bundle advertised by the remote server, which allows the server-side to offload parts
    of the clone to a CDN. The Git client does not perform sufficient validation of the advertised bundles,
    which allows the remote side to perform protocol injection. This protocol injection can cause the client
    to write the fetched bundle to a location controlled by the adversary. The fetched content is fully
    controlled by the server, which can in the worst case lead to arbitrary code execution. The use of bundle
    URIs is not enabled by default and can be controlled by the bundle.heuristic config option. Some cases of
    the vulnerability require that the adversary is in control of where a repository will be cloned to. This
    either requires social engineering or a recursive clone with submodules. These cases can thus be avoided
    by disabling recursive clones. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3,
    v2.48.2, v2.49.1, and v2.50.1.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://mirrors.tencent.com/tlinux/errata/tssa-20250995.xml");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:A");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-48385");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2024-52006");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/01/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/07/23");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/01/14");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:tencent:tencentos_server:3");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:tencent:tencentos_server:git");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tencent Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/etc/os-release", "Host/TencentOS/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'TencentOS' >!< os_product) audit(AUDIT_OS_NOT, 'TencentOS');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'TencentOS');
if (! preg(pattern:"^3([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'TencentOS 3.x', 'TencentOS ' + os_version);

if (!get_kb_item('Host/TencentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'TencentOS', cpu);

var constraints = [
  {
    'release': '3',
    'pkgs': [
      {'reference':'git-2.43.7-1.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'git-2.43.7-1.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'git-all-2.43.7-1.tl3', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'git-core-2.43.7-1.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'git-core-2.43.7-1.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'git-core-debuginfo-2.43.7-1.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'git-core-debuginfo-2.43.7-1.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'git-core-doc-2.43.7-1.tl3', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'git-credential-libsecret-2.43.7-1.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'git-credential-libsecret-2.43.7-1.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'git-credential-libsecret-debuginfo-2.43.7-1.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'git-credential-libsecret-debuginfo-2.43.7-1.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'git-daemon-2.43.7-1.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'git-daemon-2.43.7-1.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'git-daemon-debuginfo-2.43.7-1.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'git-daemon-debuginfo-2.43.7-1.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'git-debuginfo-2.43.7-1.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'git-debuginfo-2.43.7-1.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'git-debugsource-2.43.7-1.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'git-debugsource-2.43.7-1.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'git-email-2.43.7-1.tl3', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'git-gui-2.43.7-1.tl3', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'git-instaweb-2.43.7-1.tl3', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'git-subtree-2.43.7-1.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'git-subtree-2.43.7-1.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'git-svn-2.43.7-1.tl3', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'gitk-2.43.7-1.tl3', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'gitweb-2.43.7-1.tl3', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'perl-Git-2.43.7-1.tl3', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'perl-Git-SVN-2.43.7-1.tl3', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'git / git-all / git-core / etc');
}