AlmaLinux 9.6 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1788353293)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(359867);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/01");

  script_cve_id(
    "CVE-2026-65182",
    "CVE-2026-65183",
    "CVE-2026-65905",
    "CVE-2026-65927",
    "CVE-2026-66422",
    "CVE-2026-68525",
    "CVE-2026-68569",
    "CVE-2026-68763"
  );
  script_xref(name:"CLSA", value:"2026:1788353293");

  script_name(english:"AlmaLinux 9.6 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1788353293)");

  script_set_attribute(attribute:"synopsis", value:
"The AlmaLinux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare
ALMALINUX9.6:CLSA-2026:1788353293 advisory.

  - Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security
    constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for
    a shorter sub-path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1
    through 10.1.57, from 9.0.0.M1 through 9.0.120, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
    Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.
    (CVE-2026-65182)

  - Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain
    sockets allows an unauthorised local user to access the unix domain socket. This issue affects Apache
    Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.42 through 9.0.120. Users
    are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue. (CVE-2026-65183)

  - Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before
    windowSize requests have been made, a client makes a DIGEST authenticated request with a nonceCount on the
    upper boundary of the replay window then that request is replayable once only while the associated
    nonceCount remains within the replay window. This issue affects Apache Tomcat: from 11.0.0-M1 through
    11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120. The following versions were EOL at
    the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.30 through
    7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version
    11.0.25, 10.1.58 or 9.0.121, which fix the issue. (CVE-2026-65905)

  - Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes
    rewrite processing to restart at the second rule rather than the first rule. This issue affects Apache
    Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120. The
    following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0
    through 8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to
    version 11.0.25, 10.1.58 or 9.0.121 which fix the issue. (CVE-2026-65927)

  - Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being
    incorrectly used as role aliases within the Realm in additional to the correct usage with
    Request.isUserInRole(). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1
    through 10.1.57, from 9.0.25 through 9.0.120. The following versions were EOL at the time the CVE was
    created but are known to be affected: from 8.5.46 through 8.5.100, from 7.0.97 through 7.0.109. Other
    unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or
    9.0.121, which fix the issue. (CVE-2026-66422)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://security.tuxcare.com/csaf/v2/els_os/tuxcare9.6esu/advisories/2026/clsa-2026_1788353293.json
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?6e173008");
  script_set_attribute(attribute:"see_also", value:"https://cve.tuxcare.com/els/releases/CLSA-2026:1788353293");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages based on the guidance in TuxCare advisory ALMALINUX9.6:CLSA-2026:1788353293.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-65905");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"vendor_severity", value:"Important");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/18");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/02");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/01");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Alma Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/OS/extended-third-party", "Host/local_checks_enabled", "Host/AlmaLinux/release", "Host/AlmaLinux/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (empty_or_null(third_party_support) || third_party_support != 'TuxCare') exit(0, 'TuxCare support not enabled.');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'AlmaLinux' >!< os_product) audit(AUDIT_OS_NOT, 'AlmaLinux');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'AlmaLinux');
if (! preg(pattern:"^9.6([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'AlmaLinux 9.6', 'AlmaLinux ' + os_version);

if (!get_kb_item('Host/AlmaLinux/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'AlmaLinux', cpu);


var constraints = [
  {
    'release': '9',
    'sp': '6',
    'pkgs': [
      {'reference':'tomcat-9.0.87-3.el9_6.3.tuxcare.els16', 'sp':'6', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'tomcat-admin-webapps-9.0.87-3.el9_6.3.tuxcare.els16', 'sp':'6', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'tomcat-docs-webapp-9.0.87-3.el9_6.3.tuxcare.els16', 'sp':'6', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'tomcat-el-3.0-api-9.0.87-3.el9_6.3.tuxcare.els16', 'sp':'6', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'tomcat-jsp-2.3-api-9.0.87-3.el9_6.3.tuxcare.els16', 'sp':'6', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'tomcat-lib-9.0.87-3.el9_6.3.tuxcare.els16', 'sp':'6', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'tomcat-servlet-4.0-api-9.0.87-3.el9_6.3.tuxcare.els16', 'sp':'6', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'tomcat-webapps-9.0.87-3.el9_6.3.tuxcare.els16', 'sp':'6', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc');
}