TencentOS Server 3: libevent (TSSA-2026:1140)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Tencent Linux Security Advisory TSSA-2026:1140.
##

include('compat.inc');

if (description)
{
  script_id(365143);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/12");

  script_cve_id(
    "CVE-2026-63382",
    "CVE-2026-63383",
    "CVE-2026-63384",
    "CVE-2026-63385",
    "CVE-2026-63387",
    "CVE-2026-63388"
  );

  script_name(english:"TencentOS Server 3: libevent (TSSA-2026:1140)");

  script_set_attribute(attribute:"synopsis", value:
"The remote TencentOS Server 3 host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is,
therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1140 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2026-63382:
    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in
    http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding
    values, and bare line feeds in chunked framing. evhttp_find_header can select only the first header,
    evhttp_check_transfer_encoding_ was absent so the previous whole-string comparison fails to recognize
    valid lists ending in chunked, and evhttp_handle_chunked_read uses EVBUFFER_EOL_CRLF rather than
    EVBUFFER_EOL_CRLF_STRICT, accepting bare LF chunk terminators. When libevent is deployed behind a proxy
    that frames the same request differently, an unauthenticated remote attacker can desynchronize request
    boundaries and smuggle a second request, potentially bypassing access controls or poisoning caches. This
    issue is fixed in versions 2.1.13 and 2.2.2-alpha.

    CVE-2026-63383:
    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a
    contiguous evbuffer region in event_tagging.c when decode_tag_internal requests at most five bytes from
    evbuffer_pullup but iterates using the full logical buffer length. A fragmented evbuffer containing a six-
    byte malformed tag can therefore advance past the pullup window and trigger an out-of-bounds read, which
    can crash a process that decodes attacker-controlled tagged RPC data. This issue is fixed in versions
    2.1.13 and 2.2.2-alpha.

    CVE-2026-63384:
    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect
    integer conversion in event_tagging.c when evtag_unmarshal_header uses evtag_decode_int to decode an
    attacker-controlled uint32 payload length and returns it as a signed int. Values above INT_MAX become
    negative or truncated, and evtag_unmarshal_string can use the converted value in allocation sizing,
    producing a wrapped large allocation request and denial of service. This issue is fixed in versions 2.1.13
    and 2.2.2-alpha.

    CVE-2026-63385:
    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing
    weaknesses in http.c. evhttp_decode_uri_internal decodes percent-encoded %00 bytes into literal NUL
    characters, which can cause downstream C string operations to truncate a path and bypass validation
    performed on a different representation. evhttp_header_is_valid_value also accepts obsolete line folding
    in header values containing carriage return or line feed characters, allowing a proxy and libevent to
    interpret headers differently and enabling header injection or access control bypass. The CRLF header
    acceptance is fixed in versions 2.1.13 and 2.2.2-alpha, but the reviewed patches do not clearly remediate
    the URI NUL-truncation condition.

    CVE-2026-63387:
    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one
    stack buffer overflow in evdns.c when dnsname_to_labels formats a name-bearing DNS record at the end of
    the 64 KB stack buffer allocated by evdns_server_request_format_response. The final-label check permits j
    plus label_len plus one to equal buf_len, after which the terminating null byte is written to
    buf[buf_len]. A crafted DNS server response containing PTR, CNAME, MX, NS, or SOA data can trigger the
    one-byte out-of-bounds write and crash or corrupt the process. This issue is fixed in versions 2.1.13 and
    2.2.2-alpha.

    CVE-2026-63388:
    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-
    bounds write in bufferevent_sock.c when bufferevent_socket_set_conn_address_ copies a kernel-supplied
    AF_UNIX peer address into bufferevent_private.conn_address. Release builds compiled with NDEBUG disable
    the EVUTIL_ASSERT length guard, and the evhttp accept path can pass a 110-byte sockaddr from accept() into
    the 28-byte field. An unauthenticated local peer able to connect to an AF_UNIX listener can overwrite the
    adjacent dns_request pointer and heap data, causing memory corruption with confidentiality, integrity, and
    availability impact. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://mirrors.tencent.com/tlinux/errata/tssa-20261140.xml");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-63387");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-63388");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-63385");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/12");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:tencent:tencentos_server:3");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:tencent:tencentos_server:libevent");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tencent Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/etc/os-release", "Host/TencentOS/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'TencentOS' >!< os_product) audit(AUDIT_OS_NOT, 'TencentOS');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'TencentOS');
if (! preg(pattern:"^3([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'TencentOS 3.x', 'TencentOS ' + os_version);

if (!get_kb_item('Host/TencentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'TencentOS', cpu);

var constraints = [
  {
    'release': '3',
    'pkgs': [
      {'reference':'libevent-2.1.8-11.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libevent-2.1.8-11.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libevent-debuginfo-2.1.8-11.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libevent-debuginfo-2.1.8-11.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libevent-debugsource-2.1.8-11.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libevent-debugsource-2.1.8-11.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libevent-devel-2.1.8-11.tl3', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libevent-devel-2.1.8-11.tl3', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libevent-doc-2.1.8-11.tl3', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'libevent / libevent-debuginfo / libevent-debugsource / etc');
}