AlmaLinux 9.6 [TuxCare] Security Update: pki-servlet-4.0-api / pki-servlet-engine Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1775739369)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(352986);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/30");

  script_cve_id("CVE-2024-52316", "CVE-2025-46701", "CVE-2025-55754");
  script_xref(name:"CLSA", value:"2026:1775739369");

  script_name(english:"AlmaLinux 9.6 [TuxCare] Security Update: pki-servlet-4.0-api / pki-servlet-engine Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1775739369)");

  script_set_attribute(attribute:"synopsis", value:
"The AlmaLinux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare
ALMALINUX9.6:CLSA-2026:1775739369 advisory.

  - Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta
    Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the
    authentication process without explicitly setting an HTTP status to indicate failure, the authentication
    may not fail, allowing the user to bypass the authentication process. There are no known Jakarta
    Authentication components that behave in this way. This issue affects Apache Tomcat: from 11.0.0-M1
    through 11.0.0-M26, from 10.1.0-M1 through 10.1.30, from 9.0.0-M1 through 9.0.95. The following versions
    were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other EOL
    versions may also be affected. Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96,
    which fix the issue. (CVE-2024-52316)

  - Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security
    constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI
    servlet. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1 through 10.1.40,
    from 9.0.0.M1 through 9.0.104. The following versions were EOL at the time the CVE was created but are
    known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are
    recommended to upgrade to version 11.0.7, 10.1.41 or 9.0.105, which fixes the issue. (CVE-2025-46701)

  - Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. Tomcat did
    not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a Windows
    operating system, and the console supported ANSI escape sequences, it was possible for an attacker to use
    a specially crafted URL to inject ANSI escape sequences to manipulate the console and the clipboard and
    attempt to trick an administrator into running an attacker controlled command. While no attack vector was
    found, it may have been possible to mount this attack on other operating systems. This issue affects
    Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.40 through
    9.0.108. The following versions were EOL at the time the CVE was created but are known to be affected:
    8.5.60 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade
    to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue. (CVE-2025-55754)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://security.tuxcare.com/csaf/v2/els_os/tuxcare9.6esu/advisories/2026/clsa-2026_1775739369.json
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9bfb4aa0");
  script_set_attribute(attribute:"see_also", value:"https://cve.tuxcare.com/els/releases/CLSA-2026:1775739369");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages based on the guidance in TuxCare advisory ALMALINUX9.6:CLSA-2026:1775739369.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-55754");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2024-52316");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2025-46701");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"vendor_severity", value:"Important");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/10/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/04/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/30");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Alma Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/OS/extended-third-party", "Host/local_checks_enabled", "Host/AlmaLinux/release", "Host/AlmaLinux/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (empty_or_null(third_party_support) || third_party_support != 'TuxCare') exit(0, 'TuxCare support not enabled.');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'AlmaLinux' >!< os_product) audit(AUDIT_OS_NOT, 'AlmaLinux');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'AlmaLinux');
if (! preg(pattern:"^9.6([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'AlmaLinux 9.6', 'AlmaLinux ' + os_version);

if (!get_kb_item('Host/AlmaLinux/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'AlmaLinux', cpu);


var constraints = [
  {
    'release': '9',
    'sp': '6',
    'pkgs': [
      {'reference':'pki-servlet-4.0-api-9.0.50-1.el9_2.2.tuxcare.els2', 'sp':'6', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'pki-servlet-engine-9.0.50-1.el9_2.2.tuxcare.els2', 'sp':'6', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'pki-servlet-4.0-api / pki-servlet-engine');
}