TencentOS Server 3: osbuild-composer (TSSA-2026:0911)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Tencent Linux Security Advisory TSSA-2026:0911.
##

include('compat.inc');

if (description)
{
  script_id(341108);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/27");

  script_cve_id(
    "CVE-2026-32280",
    "CVE-2026-32282",
    "CVE-2026-32283",
    "CVE-2026-33186",
    "CVE-2026-34986"
  );

  script_name(english:"TencentOS Server 3: osbuild-composer (TSSA-2026:0911)");

  script_set_attribute(attribute:"synopsis", value:
"The remote TencentOS Server 3 host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is,
therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0911 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2026-32280:
    During chain building, the amount of work that is done is not correctly limited when a large number of
    intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of
    service. This affects both direct users of crypto/x509 and users of crypto/tls.

    CVE-2026-32282:
    On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress,
    Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux
    fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink
    traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink
    lying outside the root, so the impact is limited to cases where the target is replaced with a symlink
    between the check and operation.

    CVE-2026-32283:
    If one side of the TLS connection sends multiple key update messages post-handshake in a single record,
    the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of
    service. This only affects TLS 1.3.

    CVE-2026-33186:
    gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass
    resulting from improper input validation of the HTTP/2 :path pseudo-header. The gRPC-Go server was too
    lenient in its routing logic, accepting requests where the :path omitted the mandatory leading slash
    (e.g., Service/Method instead of /Service/Method). While the server successfully routed these requests to
    the correct handler, authorization interceptors (including the official grpc/authz package) evaluated the
    raw, non-canonical path string. Consequently, deny rules defined using canonical paths (starting with /)
    failed to match the incoming request, allowing it to bypass the policy if a fallback allow rule was
    present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official
    RBAC implementation in google.golang.org/grpc/authz or custom interceptors relying on info.FullMethod or
    grpc.Method(ctx); AND that have a security policy contains specific deny rules for canonical paths but
    allows other requests by default (a fallback allow rule). The vulnerability is exploitable by an
    attacker who can send raw HTTP/2 frames with malformed :path headers directly to the gRPC server. The fix
    in version 1.79.3 ensures that any request with a :path that does not start with a leading slash is
    immediately rejected with a codes.Unimplemented error, preventing it from reaching authorization
    interceptors or handlers with a non-canonical path string. While upgrading is the most secure and
    recommended path, users can mitigate the vulnerability using one of the following methods: Use a
    validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy
    hardening.

    CVE-2026-34986:
    Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go,
    including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT)
    standards. Prior to 4.1.4 and 3.0.5, decrypting a JSON Web Encryption (JWE) object will panic if the alg
    field indicates a key wrapping algorithm (one ending in KW, with the exception of A128GCMKW, A192GCMKW,
    and A256GCMKW) and the encrypted_key field is empty. The panic happens when cipher.KeyUnwrap() in
    key_wrap.go attempts to allocate a slice with a zero or negative length based on the length of the
    encrypted_key. This code path is reachable from ParseEncrypted() / ParseEncryptedJSON() /
    ParseEncryptedCompact() followed by Decrypt() on the resulting object. Note that the parse functions take
    a list of accepted key algorithms. If the accepted key algorithms do not include any key wrapping
    algorithms, parsing will fail and the application will be unaffected. This panic is also reachable by
    calling cipher.KeyUnwrap() directly with any ciphertext parameter less than 16 bytes long, but calling
    this function directly is less common. Panics can lead to denial of service. This vulnerability is fixed
    in 4.1.4 and 3.0.5.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://mirrors.tencent.com/tlinux/errata/tssa-20260911.xml");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:H/Au:M/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-32282");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/03/18");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/31");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/27");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:tencent:tencentos_server:3");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:tencent:tencentos_server:osbuild-composer");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tencent Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/etc/os-release", "Host/TencentOS/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'TencentOS' >!< os_product) audit(AUDIT_OS_NOT, 'TencentOS');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'TencentOS');
if (! preg(pattern:"^3([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'TencentOS 3.x', 'TencentOS ' + os_version);

if (!get_kb_item('Host/TencentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'TencentOS', cpu);

var constraints = [
  {
    'release': '3',
    'pkgs': [
      {'reference':'osbuild-composer-101.5-1.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'osbuild-composer-101.5-1.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'osbuild-composer-core-101.5-1.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'osbuild-composer-core-101.5-1.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'osbuild-composer-core-debuginfo-101.5-1.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'osbuild-composer-core-debuginfo-101.5-1.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'osbuild-composer-debuginfo-101.5-1.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'osbuild-composer-debuginfo-101.5-1.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'osbuild-composer-debugsource-101.5-1.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'osbuild-composer-debugsource-101.5-1.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'osbuild-composer-tests-debuginfo-101.5-1.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'osbuild-composer-tests-debuginfo-101.5-1.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'osbuild-composer-worker-101.5-1.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'osbuild-composer-worker-101.5-1.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'osbuild-composer-worker-debuginfo-101.5-1.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'osbuild-composer-worker-debuginfo-101.5-1.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'osbuild-composer / osbuild-composer-core / osbuild-composer-core-debuginfo / etc');
}