CentOS Linux 8 [TuxCare] Security Update: openssl / openssl-devel / openssl-libs / openssl-perl / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1790933563)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(362596);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/02");

  script_cve_id("CVE-2026-35189", "CVE-2026-84782");
  script_xref(name:"CLSA", value:"2026:1790933563");

  script_name(english:"CentOS Linux 8 [TuxCare] Security Update: openssl / openssl-devel / openssl-libs / openssl-perl / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1790933563)");

  script_set_attribute(attribute:"synopsis", value:
"The CentOS Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the
TuxCare CENTOS-STREAM8:CLSA-2026:1790933563 advisory.

  - Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes
    disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted
    certificate from a malicious peer can lead to significant memory pressure and possible Denial of Service
    in clients or in servers that solicit client certificates. CWE: CWE-770: Allocation of Resources Without
    Limits or Throttling Description: A certificate or a set of certificates that fits under the limit for
    size of certificates accepted from the peer (~100 KiB) can result in allocation of several hundred MiB of
    resident memory on the receiving side during a normal TLS handshake. This may be enough to crash the
    client or server, if multiple concurrent connections lead to similarly large memory allocations. The fix
    postpones processing of the CRL distribution points extensions in certificates to the time when the
    processed value is required for CRL processing. This avoids keeping large memory allocations for a long
    time when such certificates are received. FIPS impact: no The affected code is outside the FIPS module
    boundary. (CVE-2026-35189)

  - Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is
    suspended part-way through. The retransmitted message can be read past the message buffer and the
    retransmission overwrites the internal state the suspended write needs to resume correctly. Impact
    summary: The retransmitted message can disclose a heap memory to the peer as plaintext handshake data or
    cause a crash and a Denial of Service when the read reaches an unmapped memory region. CWE: CWE-125: Out-
    of-bounds Read Description: DTLS handshake messages can be written out in multiple fragments, and a write
    can suspend mid-message (returning WANT_WRITE) if the underlying transport temporarily cannot accept more
    data. While such a write is suspended, the DTLS retransmission timer may independently fire and ask the
    retransmission logic to resend an earlier, already-acknowledged-as-sent message from its retransmit queue.
    The retransmission logic reused the same internal buffer and position tracking as the message that was
    still being written, without resetting the position back to the start of the message being retransmitted.
    As a result the retransmission was read starting from wherever the suspended write had left off, producing
    a mislabelled message whose body was leftover bytes from the other, larger message still in flight -
    content that was never meant to be sent at that point, and which could run past the end of the allocated
    buffer. Separately, even when the retransmission is positioned correctly, allowing it to run to completion
    while another write is suspended overwrites the same shared bookkeeping that the suspended write depends
    on to resume. When the application later resumes the suspended write (via a subsequent SSL_read(),
    SSL_write(), SSL_accept(), or SSL_connect() call), it finds that bookkeeping in a state inconsistent with
    the message and aborts the process in a debugging build. The fix resets the retransmission's read position
    to the start of the message before resending, and skips retransmission entirely whenever a handshake write
    is still suspended, deferring to the next call that resumes it instead. FIPS impact: no The affected code
    is outside the FIPS module boundary. (CVE-2026-84782)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://security.tuxcare.com/csaf/v2/els_os/centos-stream8els/advisories/2026/clsa-2026_1790933563.json
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?756931cb");
  script_set_attribute(attribute:"see_also", value:"https://cve.tuxcare.com/els/releases/CLSA-2026:1790933563");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages based on the guidance in TuxCare advisory CENTOS-STREAM8:CLSA-2026:1790933563.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-84782");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"vendor_severity", value:"Important");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/29");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/02");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/02");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CentOS Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/OS/extended-third-party", "Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list");

  exit(0);
}
include('rpm2.inc');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (empty_or_null(third_party_support) || third_party_support != 'TuxCare') exit(0, 'TuxCare support not enabled.');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'CentOS Linux' >!< os_product) audit(AUDIT_OS_NOT, 'CentOS Linux');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'CentOS Linux');
if (! preg(pattern:"^8([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'CentOS Linux 8', 'CentOS Linux ' + os_version);

if (!get_kb_item('Host/CentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if (cpu !~ "^i[3-6]86$" && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'CentOS Linux', cpu);


var constraints = [
  {
    'release': '8',
    'pkgs': [
      {'reference':'openssl-1.1.1k-12.el8.tuxcare.els12', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'openssl-1.1.1k-12.el8.tuxcare.els12', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'openssl-devel-1.1.1k-12.el8.tuxcare.els12', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'openssl-devel-1.1.1k-12.el8.tuxcare.els12', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'openssl-libs-1.1.1k-12.el8.tuxcare.els12', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'openssl-libs-1.1.1k-12.el8.tuxcare.els12', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'openssl-perl-1.1.1k-12.el8.tuxcare.els12', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'openssl-perl-1.1.1k-12.el8.tuxcare.els12', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'openssl-static-1.1.1k-12.el8.tuxcare.els12', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'openssl-static-1.1.1k-12.el8.tuxcare.els12', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'openssl / openssl-devel / openssl-libs / openssl-perl / etc');
}