AlmaLinux 9.6 [TuxCare] Security Update: jq / jq-devel Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1779273835)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(362358);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/01");

  script_cve_id(
    "CVE-2026-40164",
    "CVE-2026-40612",
    "CVE-2026-41256",
    "CVE-2026-41257",
    "CVE-2026-43894",
    "CVE-2026-43895",
    "CVE-2026-43896",
    "CVE-2026-44777"
  );
  script_xref(name:"CLSA", value:"2026:1779273835");

  script_name(english:"AlmaLinux 9.6 [TuxCare] Security Update: jq / jq-devel Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1779273835)");

  script_set_attribute(attribute:"synopsis", value:
"The AlmaLinux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare
ALMALINUX9.6:CLSA-2026:1779273835 advisory.

  - jq is a command-line JSON processor. Before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784, jq used
    MurmurHash3 with a hardcoded, publicly visible seed (0x432A9843) for all JSON object hash table
    operations, which allowed an attacker to precompute key collisions offline. By supplying a crafted JSON
    object (~100 KB) where all keys hashed to the same bucket, hash table lookups degraded from O(1) to O(n),
    turning any jq expression into an O(n) operation and causing significant CPU exhaustion. This affected
    common jq use cases such as CI/CD pipelines, web services, and data processing scripts, and was far more
    practical to exploit than existing heap overflow issues since it required only a small payload. This issue
    has been patched in commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784. (CVE-2026-40164)

  - jq is a command-line JSON processor. In 1.8.1 and earlier, jv_contains recurses into nested arrays/objects
    with no depth limit. With a sufficiently nested input structure (built programmatically with reduce, since
    the JSON parser caps at depth 10000), the C stack is exhausted. (CVE-2026-40612)

  - jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with
    -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as .
    followed by \x00 and arbitrary suffix compiles and executes as only the prefix before the NUL. This leaves
    jq with a post-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path even though the JSON
    parser path has already been fixed. (CVE-2026-41256)

  - jq is a command-line JSON processor. In 1.8.1 and earlier, the jq bytecode VM's data stack tracks its
    allocation size in a signed int. When the stack grows beyond 1 GiB (via deeply nested generator forks),
    the doubling arithmetic overflows. The wrapped value is passed to realloc and then used for a memmove with
    attacker-influenced offsets. (CVE-2026-41257)

  - jq is a command-line JSON processor. In 1.8.1 and earlier, when decNumberFromString is given a number
    literal of INT_MAX-1 (2147483646) digits, the D2U() macro overflows during signed-int arithmetic. The
    wrapped negative value bypasses the heap-allocation size check, causes the function to use a 30-byte stack
    buffer, and then writes 715 million 16-bit units (1.4 GiB) at an offset 1.43 GiB below the stack frame.
    The written content is fully attacker-controlled (the parsed decimal digits, packed 3-per-unit).
    (CVE-2026-43894)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://security.tuxcare.com/csaf/v2/els_os/tuxcare9.6esu/advisories/2026/clsa-2026_1779273835.json
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ecb5c6d7");
  script_set_attribute(attribute:"see_also", value:"https://cve.tuxcare.com/els/releases/CLSA-2026:1779273835");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages based on the guidance in TuxCare advisory ALMALINUX9.6:CLSA-2026:1779273835.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-44777");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-41257");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"vendor_severity", value:"Important");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/04/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/05/20");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/01");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Alma Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/OS/extended-third-party", "Host/local_checks_enabled", "Host/AlmaLinux/release", "Host/AlmaLinux/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (empty_or_null(third_party_support) || third_party_support != 'TuxCare') exit(0, 'TuxCare support not enabled.');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'AlmaLinux' >!< os_product) audit(AUDIT_OS_NOT, 'AlmaLinux');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'AlmaLinux');
if (! preg(pattern:"^9.6([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'AlmaLinux 9.6', 'AlmaLinux ' + os_version);

if (!get_kb_item('Host/AlmaLinux/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if (cpu !~ "^i[3-6]86$" && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'AlmaLinux', cpu);


var constraints = [
  {
    'release': '9',
    'sp': '6',
    'pkgs': [
      {'reference':'jq-1.6-17.el9_6.2.tuxcare.els3', 'sp':'6', 'cpu':'i686', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'jq-1.6-17.el9_6.2.tuxcare.els3', 'sp':'6', 'cpu':'x86_64', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'jq-devel-1.6-17.el9_6.2.tuxcare.els3', 'sp':'6', 'cpu':'i686', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'jq-devel-1.6-17.el9_6.2.tuxcare.els3', 'sp':'6', 'cpu':'x86_64', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'jq / jq-devel');
}