CentOS Linux 8 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1778174697)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(360128);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/01");

  script_cve_id(
    "CVE-2026-24072",
    "CVE-2026-28780",
    "CVE-2026-29169",
    "CVE-2026-33006",
    "CVE-2026-33007",
    "CVE-2026-33523",
    "CVE-2026-33857",
    "CVE-2026-34032",
    "CVE-2026-34059"
  );
  script_xref(name:"CLSA", value:"2026:1778174697");

  script_name(english:"CentOS Linux 8 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1778174697)");

  script_set_attribute(attribute:"synopsis", value:
"The CentOS Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the
TuxCare CENTOS-STREAM8:CLSA-2026:1778174697 advisory.

  - An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess
    authors to read files with the privileges of the httpd user. Users are recommended to upgrade to version
    2.4.67, which fixes this issue. (CVE-2026-24072)

  - Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects
    to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause
    it to write 4 attacker controlled bytes after the end of a heap based buffer. This issue affects Apache
    HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
    (CVE-2026-28780)

  - A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker
    to crash the server with a malicious request.mod_dav_lock is not used internally by mod_dav or mod_dav_fs.
    The only known use-case for mod_dav_lock was mod_dav_svn from Apache Subversion earlier than version
    1.2.0. Users are recommended to upgrade to version 2.4.66, which fixes this issue, or remove mod_dav_lock.
    (CVE-2026-29169)

  - A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest
    authentication by a remote attacker. Users are recommended to upgrade to version 2.4.67, which fixes this
    issue. (CVE-2026-33006)

  - A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and earlier allows an
    unauthenticated remote user to crash a child process in a caching forward proxy configuration. Users are
    recommended to upgrade to version 2.4.67, which fixes this issue. (CVE-2026-33007)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://security.tuxcare.com/csaf/v2/els_os/centos-stream8els/advisories/2026/clsa-2026_1778174697.json
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c70bba3f");
  script_set_attribute(attribute:"see_also", value:"https://cve.tuxcare.com/els/releases/CLSA-2026:1778174697");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages based on the guidance in TuxCare advisory CENTOS-STREAM8:CLSA-2026:1778174697.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-28780");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-24072");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"vendor_severity", value:"Important");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/05/04");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/05/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/01");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CentOS Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/OS/extended-third-party", "Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list");

  exit(0);
}
include('rpm2.inc');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (empty_or_null(third_party_support) || third_party_support != 'TuxCare') exit(0, 'TuxCare support not enabled.');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'CentOS Linux' >!< os_product) audit(AUDIT_OS_NOT, 'CentOS Linux');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'CentOS Linux');
if (! preg(pattern:"^8([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'CentOS Linux 8', 'CentOS Linux ' + os_version);

if (!get_kb_item('Host/CentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'CentOS Linux', cpu);


var constraints = [
  {
    'release': '8',
    'pkgs': [
      {'reference':'httpd-2.4.37-64.module_el8+2399+623e4f50.tuxcare.els6', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'httpd-devel-2.4.37-64.module_el8+2399+623e4f50.tuxcare.els6', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'httpd-filesystem-2.4.37-64.module_el8+2399+623e4f50.tuxcare.els6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'httpd-manual-2.4.37-64.module_el8+2399+623e4f50.tuxcare.els6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'httpd-tools-2.4.37-64.module_el8+2399+623e4f50.tuxcare.els6', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'mod_ldap-2.4.37-64.module_el8+2399+623e4f50.tuxcare.els6', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'mod_proxy_html-2.4.37-64.module_el8+2399+623e4f50.tuxcare.els6', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'mod_session-2.4.37-64.module_el8+2399+623e4f50.tuxcare.els6', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'mod_ssl-2.4.37-64.module_el8+2399+623e4f50.tuxcare.els6', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc');
}