AlmaLinux 9.2 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1786121727)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(351711);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/30");

  script_cve_id(
    "CVE-2025-61795",
    "CVE-2026-24880",
    "CVE-2026-25854",
    "CVE-2026-34483",
    "CVE-2026-34487",
    "CVE-2026-50229",
    "CVE-2026-53404",
    "CVE-2026-55955"
  );
  script_xref(name:"CLSA", value:"2026:1786121727");

  script_name(english:"AlmaLinux 9.2 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1786121727)");

  script_set_attribute(attribute:"synopsis", value:
"The AlmaLinux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare
ALMALINUX9.2:CLSA-2026:1786121727 advisory.

  - Improper Resource Shutdown or Release vulnerability in Apache Tomcat. If an error occurred (including
    exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts
    written to disc were not cleaned up immediately but left for the garbage collection process to delete.
    Depending on JVM settings, application memory usage and application load, it was possible that space for
    the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS. This
    issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.11, from 10.1.0-M1 through 10.1.46, from 9.0.0.M1
    through 9.0.109. The following versions were EOL at the time the CVE was created but are known to be
    affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to
    upgrade to version 11.0.12 or later, 10.1.47 or later or 9.0.110 or later which fixes the issue.
    (CVE-2025-61795)

  - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache
    Tomcat via invalid chunk extension. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from
    10.1.0-M1 through 10.1.52, from 9.0.0.M1 through 9.0.115, from 8.5.0 through 8.5.100, from 7.0.0 through
    7.0.109. Other, unsupported versions may also be affected. Users are recommended to upgrade to version
    11.0.20, 10.1.52 or 9.0.116, which fix the issue. (CVE-2026-24880)

  - Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the
    LoadBalancerDrainingValve. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from
    10.1.0-M1 through 10.1.52, from 9.0.0.M23 through 9.0.115, from 8.5.30 through 8.5.100. Other, unsupported
    versions may also be affected Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116,
    which fix the issue. (CVE-2026-25854)

  - Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache
    Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53,
    from 9.0.40 through 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117 ,
    which fix the issue. (CVE-2026-34483)

  - Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering
    component of Apache Tomcat exposed the Kubernetes bearer token. This issue affects Apache Tomcat: from
    11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.13 through 9.0.116. Users are
    recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue. (CVE-2026-34487)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://security.tuxcare.com/csaf/v2/els_os/almalinux9.2esu/advisories/2026/clsa-2026_1786121727.json
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2b88204c");
  script_set_attribute(attribute:"see_also", value:"https://cve.tuxcare.com/els/releases/CLSA-2026:1786121727");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages based on the guidance in TuxCare advisory ALMALINUX9.2:CLSA-2026:1786121727.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-34487");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-25854");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"vendor_severity", value:"Moderate");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/02/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/30");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Alma Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/OS/extended-third-party", "Host/local_checks_enabled", "Host/AlmaLinux/release", "Host/AlmaLinux/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (empty_or_null(third_party_support) || third_party_support != 'TuxCare') exit(0, 'TuxCare support not enabled.');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'AlmaLinux' >!< os_product) audit(AUDIT_OS_NOT, 'AlmaLinux');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'AlmaLinux');
if (! preg(pattern:"^9.2([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'AlmaLinux 9.2', 'AlmaLinux ' + os_version);

if (!get_kb_item('Host/AlmaLinux/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'AlmaLinux', cpu);


var constraints = [
  {
    'release': '9',
    'sp': '2',
    'pkgs': [
      {'reference':'tomcat-9.0.62-12.el9_2.1.tuxcare.els8', 'sp':'2', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'tomcat-admin-webapps-9.0.62-12.el9_2.1.tuxcare.els8', 'sp':'2', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'tomcat-docs-webapp-9.0.62-12.el9_2.1.tuxcare.els8', 'sp':'2', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'tomcat-el-3.0-api-9.0.62-12.el9_2.1.tuxcare.els8', 'sp':'2', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'tomcat-jsp-2.3-api-9.0.62-12.el9_2.1.tuxcare.els8', 'sp':'2', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'tomcat-lib-9.0.62-12.el9_2.1.tuxcare.els8', 'sp':'2', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'tomcat-servlet-4.0-api-9.0.62-12.el9_2.1.tuxcare.els8', 'sp':'2', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'tomcat-webapps-9.0.62-12.el9_2.1.tuxcare.els8', 'sp':'2', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc');
}