AlmaLinux 9.6 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1776601980)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(360681);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/01");

  script_cve_id(
    "CVE-2023-28320",
    "CVE-2023-46219",
    "CVE-2024-7264",
    "CVE-2024-11053",
    "CVE-2025-14017"
  );
  script_xref(name:"CLSA", value:"2026:1776601980");

  script_name(english:"AlmaLinux 9.6 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1776601980)");

  script_set_attribute(attribute:"synopsis", value:
"The AlmaLinux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare
ALMALINUX9.6:CLSA-2026:1776601980 advisory.

  - A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different
    backends for resolving host names, selected at build time. If it is built to use the synchronous resolver,
    it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this,
    libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore
    crash or otherwise misbehave. (CVE-2023-28320)

  - When saving HSTS data to an excessively long file name, curl could end up removing all contents, making
    subsequent requests using that file unaware of the HSTS status they should otherwise use. (CVE-2023-46219)

  - When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the
    password used for the first host to the followed-to host under certain circumstances. This flaw only
    manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry
    either omits just the password or omits both login and password. (CVE-2024-11053)

  - libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time
    field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the
    *time fraction*, leading to a `strlen()` getting performed on a pointer to a heap buffer area that is not
    (purposely) null terminated. This flaw most likely leads to a crash, but can also lead to heap contents
    getting returned to the application when
    [CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used. (CVE-2024-7264)

  - When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread
    would inadvertently change them globally and therefore possibly also affect other concurrently setup
    transfers. Disabling certificate verification for a specific transfer could unintentionally disable the
    feature for other threads as well. (CVE-2025-14017)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://security.tuxcare.com/csaf/v2/els_os/tuxcare9.6esu/advisories/2026/clsa-2026_1776601980.json
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ffc6048f");
  script_set_attribute(attribute:"see_also", value:"https://cve.tuxcare.com/els/releases/CLSA-2026:1776601980");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages based on the guidance in TuxCare advisory ALMALINUX9.6:CLSA-2026:1776601980.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-46219");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"vendor_severity", value:"Moderate");

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/05/18");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/04/19");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/01");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Alma Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/OS/extended-third-party", "Host/local_checks_enabled", "Host/AlmaLinux/release", "Host/AlmaLinux/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (empty_or_null(third_party_support) || third_party_support != 'TuxCare') exit(0, 'TuxCare support not enabled.');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'AlmaLinux' >!< os_product) audit(AUDIT_OS_NOT, 'AlmaLinux');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'AlmaLinux');
if (! preg(pattern:"^9.6([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'AlmaLinux 9.6', 'AlmaLinux ' + os_version);

if (!get_kb_item('Host/AlmaLinux/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if (cpu !~ "^i[3-6]86$" && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'AlmaLinux', cpu);


var constraints = [
  {
    'release': '9',
    'sp': '6',
    'pkgs': [
      {'reference':'curl-7.76.1-31.el9_6.1.tuxcare.els9', 'sp':'6', 'cpu':'x86_64', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'curl-minimal-7.76.1-31.el9_6.1.tuxcare.els9', 'sp':'6', 'cpu':'x86_64', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libcurl-7.76.1-31.el9_6.1.tuxcare.els9', 'sp':'6', 'cpu':'i686', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libcurl-7.76.1-31.el9_6.1.tuxcare.els9', 'sp':'6', 'cpu':'x86_64', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libcurl-devel-7.76.1-31.el9_6.1.tuxcare.els9', 'sp':'6', 'cpu':'i686', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libcurl-devel-7.76.1-31.el9_6.1.tuxcare.els9', 'sp':'6', 'cpu':'x86_64', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libcurl-minimal-7.76.1-31.el9_6.1.tuxcare.els9', 'sp':'6', 'cpu':'i686', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libcurl-minimal-7.76.1-31.el9_6.1.tuxcare.els9', 'sp':'6', 'cpu':'x86_64', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal');
}