CentOS Linux 8 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1791395301)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(363881);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/09");

  script_cve_id(
    "CVE-2025-1218",
    "CVE-2025-14181",
    "CVE-2026-6103",
    "CVE-2026-91765",
    "CVE-2026-91766",
    "CVE-2026-91767",
    "CVE-2026-91768",
    "CVE-2026-91769",
    "CVE-2026-92842",
    "CVE-2026-93682"
  );
  script_xref(name:"CLSA", value:"2026:1791395301");
  script_xref(name:"IAVA", value:"2026-A-1074");

  script_name(english:"CentOS Linux 8 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1791395301)");

  script_set_attribute(attribute:"synopsis", value:
"The CentOS Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the
TuxCare CENTOS-STREAM8:CLSA-2026:1791395301 advisory.

  - The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still
    holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make
    the client read past the end of the packet buffer, which is undefined behaviour and can crash the process.
    (CVE-2025-1218)

  - The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer
    overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away,
    a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes
    into it, producing a heap buffer overflow. (CVE-2025-14181)

  - phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The
    field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently
    wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file
    content as the next TAR header, which lets a crafted archive inject entries that PharData reports and
    extracts as if they were genuine. (CVE-2026-6103)

  - cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An
    unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any
    SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the
    SOAP value decoder and in the WSDL node search helper. (CVE-2026-91765)

  - When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and
    Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different
    port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials
    that were only meant for the original origin. This is the same class of issue that libcurl fixed in 7.58.0
    ( CVE-2018-1000007 https://github.com/advisories/GHSA-g7x2-hrfp-pv5f ). (CVE-2026-91766)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://security.tuxcare.com/csaf/v2/els_os/centos-stream8els/advisories/2026/clsa-2026_1791395301.json
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b3f0d4b2");
  script_set_attribute(attribute:"see_also", value:"https://cve.tuxcare.com/els/releases/CLSA-2026:1791395301");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages based on the guidance in TuxCare advisory CENTOS-STREAM8:CLSA-2026:1791395301.");
  script_set_cvss_base_vector("CVSS2#AV:A/AC:L/Au:N/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-91768");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"vendor_severity", value:"Important");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/22");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/07");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CentOS Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/OS/extended-third-party", "Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list");

  exit(0);
}
include('rpm2.inc');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (empty_or_null(third_party_support) || third_party_support != 'TuxCare') exit(0, 'TuxCare support not enabled.');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'CentOS Linux' >!< os_product) audit(AUDIT_OS_NOT, 'CentOS Linux');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'CentOS Linux');
if (! preg(pattern:"^8([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'CentOS Linux 8', 'CentOS Linux ' + os_version);

if (!get_kb_item('Host/CentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if (cpu !~ "^i[3-6]86$" && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'CentOS Linux', cpu);


var constraints = [
  {
    'release': '8',
    'pkgs': [
      {'reference':'php-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-bcmath-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-bcmath-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-cli-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-cli-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-common-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-common-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-dba-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-dba-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-dbg-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-dbg-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-devel-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-devel-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-embedded-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-embedded-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-enchant-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-enchant-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-fpm-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-fpm-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-gd-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-gd-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-gmp-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-gmp-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-intl-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-intl-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-json-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-json-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-ldap-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-ldap-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-mbstring-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-mbstring-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-mysqlnd-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-mysqlnd-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-odbc-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-odbc-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-opcache-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-opcache-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-pdo-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-pdo-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-pgsql-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-pgsql-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-process-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-process-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-recode-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-recode-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-snmp-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-snmp-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-soap-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-soap-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-xml-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-xml-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-xmlrpc-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'php-xmlrpc-7.2.24-1.module_el8+2640+cb0155b7.tuxcare.els29', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc');
}