TencentOS Server 4: libevent (TSSA-2026:1051)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Tencent Linux Security Advisory TSSA-2026:1051.
##

include('compat.inc');

if (description)
{
  script_id(353435);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/30");

  script_cve_id(
    "CVE-2026-63379",
    "CVE-2026-63381",
    "CVE-2026-63383",
    "CVE-2026-63384",
    "CVE-2026-63385",
    "CVE-2026-63387"
  );

  script_name(english:"TencentOS Server 4: libevent (TSSA-2026:1051)");

  script_set_attribute(attribute:"synopsis", value:
"The remote TencentOS Server 4 host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is,
therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1051 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-63387:
    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one
    stack buffer overflow in evdns.c when dnsname_to_labels formats a name-bearing DNS record at the end of
    the 64 KB stack buffer allocated by evdns_server_request_format_response.

    CVE-2026-63385:
    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing
    weaknesses in http.c. evhttp_decode_uri_internal decodes percent-encoded %00 bytes into literal NUL
    characters, which can cause downstream C string operations to truncate a path and bypass validation
    performed on a different representation. evhttp_header_is_valid_value also accepts obsolete line folding
    in header values containing carriage return or line feed characters, allowing a proxy and libevent to
    interpret headers differently and enabling header injection or access control bypass.

    CVE-2026-63384:
    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect
    integer conversion in event_tagging.c when evtag_unmarshal_header uses evtag_decode_int to decode an
    attacker-controlled uint32 payload length and returns it as a signed int. Values above INT_MAX become
    negative or truncated, and evtag_unmarshal_string can use the converted value in allocation sizing,
    producing a wrapped large allocation request and denial of service. This issue is fixed in versions 2.1.13
    and 2.2.2-alpha.

    CVE-2026-63383:
    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a
    contiguous evbuffer region in event_tagging.c when decode_tag_internal requests at most five bytes from
    evbuffer_pullup but iterates using the full logical buffer length. A fragmented evbuffer containing a six-
    byte malformed tag can therefore advance past the pullup window and trigger an out-of-bounds read, which
    can crash a process that decodes attacker-controlled tagged RPC data. This issue is fixed in versions
    2.1.13 and 2.2.2-alpha.

    CVE-2026-63381:
    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free
    in buffer.c when evbuffer_add_buffer_reference processes an output buffer whose out_total_len is zero.

    CVE-2026-63379:
    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked
    HTTP trailers in http.c through evhttp_read_trailer and merges them into request headers. The fix
    introduces evhttp_parse_headers_impl_ and a temporary trailer header list. An unauthenticated remote
    attacker can place security-sensitive fields in trailers so that an upstream proxy and the libevent
    application interpret different effective headers, enabling header smuggling, authorization bypass, proxy-
    header spoofing, or cache poisoning. The fix parses trailers into a temporary header list and discards
    them instead of merging them into req->input_headers. This issue is fixed in versions 2.1.13 and
    2.2.2-alpha.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://mirrors.tencent.com/tlinux/errata/tssa-20261051.xml");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-63387");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-63385");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/28");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/30");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:tencent:tencentos_server:4");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:tencent:tencentos_server:libevent");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tencent Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/etc/os-release", "Host/TencentOS/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'TencentOS' >!< os_product) audit(AUDIT_OS_NOT, 'TencentOS');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'TencentOS');
if (! preg(pattern:"^4([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'TencentOS 4.x', 'TencentOS ' + os_version);

if (!get_kb_item('Host/TencentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'TencentOS', cpu);

var constraints = [
  {
    'release': '4',
    'pkgs': [
      {'reference':'libevent-2.1.12-8.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libevent-2.1.12-8.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libevent-debuginfo-2.1.12-8.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libevent-debuginfo-2.1.12-8.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libevent-debugsource-2.1.12-8.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libevent-debugsource-2.1.12-8.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libevent-devel-2.1.12-8.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libevent-devel-2.1.12-8.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'libevent / libevent-debuginfo / libevent-debugsource / etc');
}