TencentOS Server 4: tomcat (TSSA-2026:0247)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Tencent Linux Security Advisory TSSA-2026:0247.
##

include('compat.inc');

if (description)
{
  script_id(319753);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/08");

  script_cve_id(
    "CVE-2025-66614",
    "CVE-2026-24734",
    "CVE-2026-24880",
    "CVE-2026-25854",
    "CVE-2026-29129",
    "CVE-2026-29145",
    "CVE-2026-29146",
    "CVE-2026-34487",
    "CVE-2026-34500"
  );
  script_xref(name:"IAVA", value:"2026-A-0175-S");
  script_xref(name:"IAVA", value:"2026-A-0319-S");

  script_name(english:"TencentOS Server 4: tomcat (TSSA-2026:0247)");

  script_set_attribute(attribute:"synopsis", value:
"The remote TencentOS Server 4 host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is,
therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0247 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-34500:
    CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM
    is used in Apache Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from
    9.0.92 through 9.0.116.

    Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue.

    CVE-2026-34487:
    Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering
    component of Apache Tomcat exposed the Kubernetes bearer token.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from
    9.0.13 through 9.0.116.

    Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

    CVE-2026-29146:
    Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from
    9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.

    Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.

    CVE-2026-29145:
    CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled
    vulnerability in Apache Tomcat, Apache Tomcat Native.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from
    9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from
    1.3.0 through 1.3.6, from 2.0.0 through 2.0.13.

    Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and
    9.0.116, which fix the issue.

    CVE-2026-29129:
    Configured cipher preference order not preserved vulnerability in Apache Tomcat.

    This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114
    through 9.0.115.

    Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.

    CVE-2026-25854:
    Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the
    LoadBalancerDrainingValve.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from
    9.0.0.M23 through 9.0.115, from 8.5.30 through 8.5.100.
    Other, unsupported versions may also be affected

    Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.

    CVE-2026-24880:
    Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache
    Tomcat via invalid chunk extension.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from
    9.0.0.M1 through 9.0.115, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
    Other, unsupported versions may also be affected.

    Users are recommended to upgrade to version 11.0.20, 10.1.52 or 9.0.116, which fix the issue.

    CVE-2026-24734:
    Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat.

    When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not
    complete verification or freshness checks on the OCSP response which could allow certificate revocation to
    be bypassed.

    This issue affects Apache Tomcat Native: from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11; Apache
    Tomcat: from 11.0.0-M1 through 11.0.17, from 10.1.0-M7 through 10.1.51, from 9.0.83 through 9.0.114.


    The following versions were EOL at the time the CVE was created but are
    known to be affected: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39.Older EOL versions are not
    affected.

    Apache Tomcat Native users are recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which
    fix the issue.

    Apache Tomcat users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115
    or later which fix the issue.

    CVE-2025-66614:
    Improper Input Validation vulnerability.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from
    9.0.0-M1 through 9.0.112.

    The following versions were EOL at the time the CVE was created but are
    known to be affected: 8.5.0 through 8.5.100. Older EOL versions are not affected.
    Tomcat did not validate that the host name provided via the SNI
    extension was the same as the host name provided in the HTTP host header
    field. If Tomcat was configured with more than one virtual host and the
    TLS configuration for one of those hosts did not require client
    certificate authentication but another one did, it was possible for a
    client to bypass the client certificate authentication by sending
    different host names in the SNI extension and the HTTP host header field.



    The vulnerability only applies if client certificate authentication is
    only enforced at the Connector. It does not apply if client certificate
    authentication is enforced at the web application.


    Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which
    fix the issue.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://mirrors.tencent.com/tlinux/errata/tssa-20260247.xml");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-66614");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-29146");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/12/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/04");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/08");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:tencent:tencentos_server:4");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:tencent:tencentos_server:tomcat");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tencent Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/etc/os-release", "Host/TencentOS/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'TencentOS' >!< os_product) audit(AUDIT_OS_NOT, 'TencentOS');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'TencentOS');
if (! preg(pattern:"^4([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'TencentOS 4.x', 'TencentOS ' + os_version);

if (!get_kb_item('Host/TencentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'TencentOS', cpu);

var constraints = [
  {
    'release': '4',
    'pkgs': [
      {'reference':'tomcat-9.0.117-1.tl4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'tomcat-admin-webapps-9.0.117-1.tl4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'tomcat-docs-webapp-9.0.117-1.tl4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'tomcat-el-3.0-api-9.0.117-1.tl4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'tomcat-jsp-2.3-api-9.0.117-1.tl4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'tomcat-lib-9.0.117-1.tl4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'tomcat-servlet-4.0-api-9.0.117-1.tl4', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'tomcat-webapps-9.0.117-1.tl4', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc');
}