AlmaLinux 9.2 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1776599416)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(351856);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/30");

  script_cve_id(
    "CVE-2023-46219",
    "CVE-2024-11053",
    "CVE-2025-0725",
    "CVE-2025-14017"
  );
  script_xref(name:"CLSA", value:"2026:1776599416");

  script_name(english:"AlmaLinux 9.2 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1776599416)");

  script_set_attribute(attribute:"synopsis", value:
"The AlmaLinux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare
ALMALINUX9.2:CLSA-2026:1776599416 advisory.

  - When saving HSTS data to an excessively long file name, curl could end up removing all contents, making
    subsequent requests using that file unaware of the HSTS status they should otherwise use. (CVE-2023-46219)

  - When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the
    password used for the first host to the followed-to host under certain circumstances. This flaw only
    manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry
    either omits just the password or omits both login and password. (CVE-2024-11053)

  - When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the
    `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow
    would make libcurl perform a buffer overflow. (CVE-2025-0725)

  - When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread
    would inadvertently change them globally and therefore possibly also affect other concurrently setup
    transfers. Disabling certificate verification for a specific transfer could unintentionally disable the
    feature for other threads as well. (CVE-2025-14017)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://security.tuxcare.com/csaf/v2/els_os/almalinux9.2esu/advisories/2026/clsa-2026_1776599416.json
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?6e5d1d66");
  script_set_attribute(attribute:"see_also", value:"https://cve.tuxcare.com/els/releases/CLSA-2026:1776599416");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages based on the guidance in TuxCare advisory ALMALINUX9.2:CLSA-2026:1776599416.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-46219");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"vendor_severity", value:"Moderate");

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/12/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/04/19");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/30");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Alma Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/OS/extended-third-party", "Host/local_checks_enabled", "Host/AlmaLinux/release", "Host/AlmaLinux/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (empty_or_null(third_party_support) || third_party_support != 'TuxCare') exit(0, 'TuxCare support not enabled.');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'AlmaLinux' >!< os_product) audit(AUDIT_OS_NOT, 'AlmaLinux');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'AlmaLinux');
if (! preg(pattern:"^9.2([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'AlmaLinux 9.2', 'AlmaLinux ' + os_version);

if (!get_kb_item('Host/AlmaLinux/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if (cpu !~ "^i[3-6]86$" && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'AlmaLinux', cpu);


var constraints = [
  {
    'release': '9',
    'sp': '2',
    'pkgs': [
      {'reference':'curl-7.76.1-31.el9_2.1.tuxcare.els9', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'curl-minimal-7.76.1-31.el9_2.1.tuxcare.els9', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libcurl-7.76.1-31.el9_2.1.tuxcare.els9', 'sp':'2', 'cpu':'i686', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libcurl-7.76.1-31.el9_2.1.tuxcare.els9', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libcurl-devel-7.76.1-31.el9_2.1.tuxcare.els9', 'sp':'2', 'cpu':'i686', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libcurl-devel-7.76.1-31.el9_2.1.tuxcare.els9', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libcurl-minimal-7.76.1-31.el9_2.1.tuxcare.els9', 'sp':'2', 'cpu':'i686', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libcurl-minimal-7.76.1-31.el9_2.1.tuxcare.els9', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal');
}