AlmaLinux 9.2 [TuxCare] Security Update: openssl / openssl-devel / openssl-libs / openssl-perl Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1782152259)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(362097);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/01");

  script_cve_id(
    "CVE-2026-7383",
    "CVE-2026-34182",
    "CVE-2026-42770",
    "CVE-2026-45445",
    "CVE-2026-45447"
  );
  script_xref(name:"CLSA", value:"2026:1782152259");

  script_name(english:"AlmaLinux 9.2 [TuxCare] Security Update: openssl / openssl-devel / openssl-libs / openssl-perl Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1782152259)");

  script_set_attribute(attribute:"synopsis", value:
"The AlmaLinux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare
ALMALINUX9.2:CLSA-2026:1782152259 advisory.

  - Issue Summary: Cryptographic Message Services (CMS) processing fails to perform sufficient input
    validation on the cipher and tag length fields of AuthEnvelopedData containers, leading to various
    potential compromises. Impact Summary: Attackers making use of these vulnerabilities may achieve key-
    equivalent functionality for a given CMS recipient and/or bypass integrity validation for a given message.
    In one use case, an attacker may send a CMS message containing AuthEnvelopedData with the cipher specified
    as a non-AEAD cipher. OpenSSL erroneously allows this selection, and attempts to decrypt and validate the
    message. An on-path attacker who captures one legitimate AES-GCM AuthEnvelopedData addressed to the victim
    can re-emit it with the recipientInfos set left byte-for-byte intact, so the victim's private key still
    unwraps the genuine CEK (the content-encryption key), but with the inner OID rewritten to AES-256-OFB
    (Output Feedback Mode, an unauthenticated keystream mode) and with an attacker-chosen IV and ciphertext.
    The victim initializes AES-256-OFB under the real CEK, never consults the MAC field, and CMS_decrypt()
    returns success. If the application under attack responds to the attacker with any indicator showing
    success or failure of the decryption effort, it is possible for the attacker to use this as an oracle to
    obtain key equivalent functionality for the CEK used for the chosen recipient of the message. In another
    use case, an attacker can reduce the tag length of the chosen AEAD cipher for a given AuthEnvelopedData
    container to be a single byte long, allowing an attacker to brute force CMS decryption, producing an
    integrity bypass for applications that trust CMS_decrypt() to reject modified content. The FIPS modules
    are not affected by this issue. (CVE-2026-34182)

  - Issue summary: When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the peer key is not
    properly checked for the subgroup membership. Impact summary: A malicious peer which presents an X9.42 key
    carrying the victim's p and g parameters, a forged q = r (a small prime factor of the cofactor
    (p1)/q_local), and a public value Y of order r can recover the victim's private key after a small number
    of key exchange attempts. When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the
    subgroup membership check Y^q  1 (mod p) is performed using the peer's own q parameter, not the local
    key's q. The peer's domain parameters are then matched against the domain parameters of the private key,
    but the value of q is not compared. A malicious peer who presents an X9.42 key carrying the victim's p, g,
    a forged q = r (a small prime factor of the cofactor), and a public value Y of order r passes all checks.
    The shared secret then takes only r distinct values, leaking priv mod r. Repeating for each small-prime
    factor of the cofactor and combining via CRT recovers the full private key (LimLee / small-subgroup-
    confinement attack). The realistic attack surface is narrow: principally CMP deployments with long-lived
    RA/CA DHX keys and bespoke enterprise or government applications using X9.42 DHX static keys with
    interactive protocols and therefore this issue was assigned Low severity. The FIPS modules in 4.0, 3.6,
    3.5, 3.4, 3.1.2 and 3.0 are affected by this issue. (CVE-2026-42770)

  - Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot
    interface, the application-supplied initialisation vector (IV) is silently discarded. Impact summary:
    Every message encrypted under the same key uses the same effective nonce regardless of the IV supplied by
    the caller, resulting in (key, nonce) reuse and loss of confidentiality. If the same code path is used to
    compute the authentication tag, the tag depends only on the (key, IV) pair and not on the plaintext or
    ciphertext, allowing universal forgery of arbitrary ciphertext from a single captured message. OpenSSL
    provides two ways to drive a cipher: the documented streaming interface (EVP_CipherUpdate /
    EVP_CipherFinal_ex) and a lower-level one-shot, EVP_Cipher(), whose documentation explicitly recommends
    against use by applications in favour of EVP_CipherUpdate() and EVP_CipherFinal_ex(). The OCB provider's
    streaming handler flushes the application-supplied IV into the OCB context before processing data; the
    one-shot handler did not. Every call to EVP_Cipher() on an AES-OCB context therefore ran with the all-zero
    key-derived offset state left by cipher initialisation, regardless of the caller's IV. If
    EVP_EncryptFinal_ex() is subsequently used to obtain the authentication tag, the deferred IV setup runs at
    that point and clears the running checksum that should have been accumulated over the plaintext. The
    resulting tag is a function of (key, IV) only and verifies against any ciphertext produced under the same
    (key, IV) pair. The OpenSSL SSL/TLS implementation is not affected: AES-OCB is not a TLS cipher suite, and
    libssl does not call EVP_Cipher() in any case. Applications that drive AES-OCB through the documented
    streaming AEAD API (EVP_CipherUpdate / EVP_CipherFinal_ex) are not affected. Only applications that
    combine the AES-OCB cipher with the EVP_Cipher() one-shot API are vulnerable. The FIPS modules in 4.0,
    3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as AES-OCB is outside the OpenSSL FIPS module
    boundary. (CVE-2026-45445)

  - Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during
    PKCS#7 signature verification. Impact summary: A use-after-free may result in process crashes, heap
    corruption, or potentially remote code execution. When processing a PKCS#7 or S/MIME signed message, if
    the SignedData digestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may incorrectly free a
    caller-owned BIO during PKCS7_verify(). A subsequent use of the BIO by the calling application results in
    a use-after-free condition. In the common case this occurs when the application later calls BIO_free() on
    the BIO originally passed to PKCS7_verify(). Depending on allocator behavior and application-specific BIO
    usage patterns, this may result in a crash or other memory corruption. In some application contexts this
    may potentially be exploitable for remote code execution. Applications that process PKCS#7 or S/MIME
    signed messages using OpenSSL PKCS#7 APIs may be affected. Applications using the CMS APIs for this
    processing are not affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this
    issue, as the affected code is outside the OpenSSL FIPS module boundary. (CVE-2026-45447)

  - Issue summary: A signed integer overflow when sizing the destination buffer for Unicode output in
    ASN1_mbstring_ncopy() can lead to a heap buffer overflow. Impact summary: A heap buffer overflow may lead
    to a crash or possibly attacker controlled code execution or other undefined behaviour. In
    ASN1_mbstring_copy() and ASN1_mbstring_ncopy() the destination size for Unicode output is computed in a
    signed int: by left shift of the input character count for BMPSTRING (UTF-16) and UNIVERSALSTRING
    (UTF-32), and by summing per-character byte counts for UTF8STRING. The calculation overflows when the
    input reaches around 2^30 characters. In the worst case (UNIVERSALSTRING at 2^30 characters) the size
    wraps to zero, OPENSSL_malloc(1) is called, and the subsequent character copy writes several gigabytes
    past the one-byte allocation. X.509 certificate processing routes through ASN1_STRING_set_by_NID(), whose
    DIRSTRING_TYPE mask excludes UNIVERSALSTRING and whose per-NID size limits cap the input length; no
    network protocol or certificate-handling path in OpenSSL exercises the overflow. Triggering the bug
    requires an application that calls ASN1_mbstring_copy() or ASN1_mbstring_ncopy() directly, or registers a
    custom string type via ASN1_STRING_TABLE_add(), with attacker-controlled input on the order of half a
    gigabyte or more. For these reasons this issue was assigned Low severity. The FIPS modules in 4.0, 3.6,
    3.5, 3.4 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module
    boundary. (CVE-2026-7383)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://security.tuxcare.com/csaf/v2/els_os/almalinux9.2esu/advisories/2026/clsa-2026_1782152259.json
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?05e6a45d");
  script_set_attribute(attribute:"see_also", value:"https://cve.tuxcare.com/els/releases/CLSA-2026:1782152259");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages based on the guidance in TuxCare advisory ALMALINUX9.2:CLSA-2026:1782152259.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-45447");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-34182");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"vendor_severity", value:"Critical");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/01");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Alma Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/OS/extended-third-party", "Host/local_checks_enabled", "Host/AlmaLinux/release", "Host/AlmaLinux/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (empty_or_null(third_party_support) || third_party_support != 'TuxCare') exit(0, 'TuxCare support not enabled.');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'AlmaLinux' >!< os_product) audit(AUDIT_OS_NOT, 'AlmaLinux');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'AlmaLinux');
if (! preg(pattern:"^9.2([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'AlmaLinux 9.2', 'AlmaLinux ' + os_version);

if (!get_kb_item('Host/AlmaLinux/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if (cpu !~ "^i[3-6]86$" && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'AlmaLinux', cpu);


var constraints = [
  {
    'release': '9',
    'sp': '2',
    'pkgs': [
      {'reference':'openssl-3.0.7-20.el9_2.tuxcare.1.els18', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'openssl-devel-3.0.7-20.el9_2.tuxcare.1.els18', 'sp':'2', 'cpu':'i686', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'openssl-devel-3.0.7-20.el9_2.tuxcare.1.els18', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'openssl-libs-3.0.7-20.el9_2.tuxcare.1.els18', 'sp':'2', 'cpu':'i686', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'openssl-libs-3.0.7-20.el9_2.tuxcare.1.els18', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'openssl-perl-3.0.7-20.el9_2.tuxcare.1.els18', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'openssl / openssl-devel / openssl-libs / openssl-perl');
}