TencentOS Server 2: gnutls (TSSA-2026:0943)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Tencent Linux Security Advisory TSSA-2026:0943.
##

include('compat.inc');

if (description)
{
  script_id(342054);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/01");

  script_cve_id(
    "CVE-2026-3833",
    "CVE-2026-42011",
    "CVE-2026-42012",
    "CVE-2026-42013",
    "CVE-2026-42014",
    "CVE-2026-42015"
  );
  script_xref(name:"IAVA", value:"2026-A-0405");

  script_name(english:"TencentOS Server 2: gnutls (TSSA-2026:0943)");

  script_set_attribute(attribute:"synopsis", value:
"The remote TencentOS Server 2 host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is,
therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0943 advisory.

    Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:

    CVE-2026-3833:
    A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons
    of nameConstraints labels, specifically for dNSName (DNS) or rfc822Name (email) constraints within
    excludedSubtrees or permittedSubtrees. A remote attacker can exploit this by crafting a leaf certificate
    with casing differences in the Subject Alternative Name (SAN), leading to a policy bypass where a
    certificate that should be rejected is instead accepted. This could result in unauthorized access or
    information disclosure.

    CVE-2026-42011:
    A flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly
    ignored when previous Certificate Authorities (CAs) only had excluded name constraints. A remote attacker
    could exploit this to bypass critical name constraint checks during certificate validation. This bypass
    could lead to the acceptance of invalid certificates, potentially enabling spoofing or man-in-the-middle
    attacks against affected systems.

    CVE-2026-42012:
    A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially
    crafted certificate that contains Uniform Resource Identifier (URI) or Service (SRV) Subject Alternative
    Names (SANs). This could cause the certificate validation process to incorrectly fall back to checking DNS
    hostnames against the Common Name (CN), potentially allowing the attacker to spoof legitimate services or
    intercept sensitive information.

    CVE-2026-42013:
    A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN)
    could cause the validation process to incorrectly fall back to checking the Common Name (CN) field. This
    could allow a remote attacker to bypass proper certificate validation, potentially leading to spoofing or
    man-in-the-middle attacks.

    CVE-2026-42014:
    A flaw was found in GnuTLS. The gnutls_pkcs11_token_set_pin function, used for changing the Security
    Officer PIN, can lead to a use-after-free vulnerability. This occurs when an attacker attempts to change
    the PIN with a NULL old PIN for a token that lacks a protected authentication path.

    CVE-2026-42015:
    A flaw was found in gnutls. An off-by-one error exists in the PKCS#12 bag element bounds check. This
    vulnerability allows an remote attacker to write past the internal array of a PKCS#12 bag when appending
    to a bag that already contains 32 elements. This memory corruption could lead to a denial of service (DoS)
    or potentially other unspecified impacts.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://mirrors.tencent.com/tlinux/errata/tssa-20260943.xml");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-3833");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/04/30");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/01");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:tencent:tencentos_server:2");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:tencent:tencentos_server:gnutls");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tencent Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/etc/os-release", "Host/TencentOS/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'TencentOS' >!< os_product) audit(AUDIT_OS_NOT, 'TencentOS');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'TencentOS');
if (! preg(pattern:"^2([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'TencentOS 2.x', 'TencentOS ' + os_version);

if (!get_kb_item('Host/TencentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'TencentOS', cpu);

var constraints = [
  {
    'release': '2',
    'pkgs': [
      {'reference':'gnutls-3.3.29-9.tl2.2', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'gnutls-c++-3.3.29-9.tl2.2', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'gnutls-dane-3.3.29-9.tl2.2', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'gnutls-debuginfo-3.3.29-9.tl2.2', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'gnutls-devel-3.3.29-9.tl2.2', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'gnutls-utils-3.3.29-9.tl2.2', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'gnutls / gnutls-c++ / gnutls-dane / etc');
}