Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : OpenSSL vulnerabilities (USN-8414-1)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Ubuntu Security Notice USN-8414-1. The text
# itself is copyright (C) Canonical, Inc. See
# <https://ubuntu.com/security/notices>. Ubuntu(R) is a registered
# trademark of Canonical, Inc.
##

include('compat.inc');

if (description)
{
  script_id(320403);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/12");

  script_cve_id(
    "CVE-2026-7383",
    "CVE-2026-9076",
    "CVE-2026-34180",
    "CVE-2026-34181",
    "CVE-2026-34182",
    "CVE-2026-34183",
    "CVE-2026-42764",
    "CVE-2026-42766",
    "CVE-2026-42767",
    "CVE-2026-42768",
    "CVE-2026-42769",
    "CVE-2026-42770",
    "CVE-2026-45445",
    "CVE-2026-45446",
    "CVE-2026-45447"
  );
  script_xref(name:"USN", value:"8414-1");
  script_xref(name:"IAVA", value:"2026-A-0589");

  script_name(english:"Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : OpenSSL vulnerabilities (USN-8414-1)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Ubuntu host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple
vulnerabilities as referenced in the USN-8414-1 advisory.

    Frank Buss discovered that OpenSSL had a heap buffer over-read in ASN.1 content parsing. An attacker could
    possibly use this issue to cause OpenSSL to crash, resulting in a denial of service, or obtain sensitive
    information. (CVE-2026-34180)

    Pavol Zacik and Alex Gaynor discovered that OpenSSL incorrectly accepted PKCS#12 files with short HMAC
    keys when using PBMAC1. An attacker could possibly use this issue to bypass integrity checks. This issue
    only affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-34181)

    Asim Viladi Oglu Manizada and Alex Gaynor discovered that OpenSSL could accept forged CMS
    AuthEnvelopedData messages. An attacker could possibly use this issue to bypass message authentication
    checks. (CVE-2026-34182)

    Abhinav Agarwal discovered that OpenSSL had unbounded memory growth in the QUIC PATH_CHALLENGE handler. A
    remote attacker could possibly use this issue to cause OpenSSL to use excessive resources, leading to a
    denial of service. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-34183)

    Sunwoo Lee, Hyuk Lim, and Seunghyun Yoon discovered that OpenSSL had a NULL pointer dereference in QUIC
    server initial packet handling. A remote attacker could possibly use this issue to cause OpenSSL to crash,
    resulting in a denial of service. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS.
    (CVE-2026-42764)

    Mayank Jangid, Kushal Khemka, Hari Priandana, Bhabani Sankar Das, and Qifan Zhang discovered that OpenSSL
    had a possible NULL dereference in password- based CMS decryption. An attacker could possibly use this
    issue to cause OpenSSL to crash, resulting in a denial of service. (CVE-2026-42766)

    Zhanpeng Liu, Guannan Wang, and Guancheng Li discovered that OpenSSL had a NULL pointer dereference in
    CRMF EncryptedValue decryption. An attacker could possibly use this issue to cause OpenSSL to crash,
    resulting in a denial of service. (CVE-2026-42767)

    Alex Gaynor discovered that OpenSSL had a Bleichenbacher oracle in CMS_decrypt() and PKCS7_decrypt() with
    multiple RecipientInfo values. An attacker could possibly use this issue to obtain sensitive information.
    This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-42768)

    Alex Gaynor discovered that OpenSSL had a trust-anchor substitution issue in CMP rootCaKeyUpdate
    processing. An attacker could possibly use this issue to bypass certificate trust validation. This issue
    only affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-42769)

    Alex Gaynor discovered that OpenSSL used attacker-supplied parameters when validating FFC-DH peers. An
    attacker could possibly use this issue to weaken key validation and compromise security guarantees.
    (CVE-2026-42770)

    Alex Gaynor discovered that OpenSSL could ignore the IV in AES-OCB mode on the EVP_Cipher() path. An
    attacker could possibly use this issue to bypass cryptographic protections and obtain sensitive
    information. (CVE-2026-45445)

    Alex Gaynor discovered that OpenSSL had incorrect tag processing for empty messages in AES-GCM-SIV and
    AES-SIV modes. An attacker could possibly use this issue to bypass cryptographic integrity checks.
    (CVE-2026-45446)

    Thai Duong discovered that OpenSSL had a heap use-after-free in PKCS7_verify(). An attacker could possibly
    use this issue to cause OpenSSL to crash, resulting in a denial of service, or execute arbitrary code.
    (CVE-2026-45447)

    Zehua Qiao and Jinwen He discovered that OpenSSL had a possible heap buffer overflow in ASN.1 multibyte
    string conversion. An attacker could possibly use this issue to cause OpenSSL to crash, resulting in a
    denial of service, or execute arbitrary code. (CVE-2026-7383)

    Bhabani Sankar Das discovered that OpenSSL had an out-of-bounds read in CMS password-based decryption. An
    attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service.
    (CVE-2026-9076)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://ubuntu.com/security/notices/USN-8414-1");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-45447");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-34182");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/11");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:22.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:24.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:25.10");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:26.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libssl-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libssl3");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libssl3t64");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:openssl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:openssl-provider-legacy");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Ubuntu Local Security Checks");

  script_copyright(english:"Ubuntu Security Notice (C) 2026 Canonical, Inc. / NASL script (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");

  exit(0);
}

include('debian_package.inc');

if ( ! get_kb_item('Host/local_checks_enabled') ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/Ubuntu/release');
if ( isnull(os_release) ) audit(AUDIT_OS_NOT, 'Ubuntu');
os_release = chomp(os_release);
if (! ('22.04' >< os_release || '24.04' >< os_release || '25.10' >< os_release || '26.04' >< os_release)) audit(AUDIT_OS_NOT, 'Ubuntu 22.04 / 24.04 / 25.10 / 26.04', 'Ubuntu ' + os_release);
if ( ! get_kb_item('Host/Debian/dpkg-l') ) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Ubuntu', cpu);

var pkgs = [
    {'osver': '22.04', 'pkgname': 'libssl-dev', 'pkgver': '3.0.2-0ubuntu1.25', 'cves': ['CVE-2026-7383', 'CVE-2026-9076', 'CVE-2026-34180', 'CVE-2026-34182', 'CVE-2026-42766', 'CVE-2026-42767', 'CVE-2026-42770', 'CVE-2026-45445', 'CVE-2026-45446', 'CVE-2026-45447']},
    {'osver': '22.04', 'pkgname': 'libssl3', 'pkgver': '3.0.2-0ubuntu1.25', 'cves': ['CVE-2026-7383', 'CVE-2026-9076', 'CVE-2026-34180', 'CVE-2026-34182', 'CVE-2026-42766', 'CVE-2026-42767', 'CVE-2026-42770', 'CVE-2026-45445', 'CVE-2026-45446', 'CVE-2026-45447']},
    {'osver': '22.04', 'pkgname': 'openssl', 'pkgver': '3.0.2-0ubuntu1.25', 'cves': ['CVE-2026-7383', 'CVE-2026-9076', 'CVE-2026-34180', 'CVE-2026-34182', 'CVE-2026-42766', 'CVE-2026-42767', 'CVE-2026-42770', 'CVE-2026-45445', 'CVE-2026-45446', 'CVE-2026-45447']},
    {'osver': '24.04', 'pkgname': 'libssl-dev', 'pkgver': '3.0.13-0ubuntu3.11', 'cves': ['CVE-2026-7383', 'CVE-2026-9076', 'CVE-2026-34180', 'CVE-2026-34182', 'CVE-2026-42766', 'CVE-2026-42767', 'CVE-2026-42770', 'CVE-2026-45445', 'CVE-2026-45446', 'CVE-2026-45447']},
    {'osver': '24.04', 'pkgname': 'libssl3t64', 'pkgver': '3.0.13-0ubuntu3.11', 'cves': ['CVE-2026-7383', 'CVE-2026-9076', 'CVE-2026-34180', 'CVE-2026-34182', 'CVE-2026-42766', 'CVE-2026-42767', 'CVE-2026-42770', 'CVE-2026-45445', 'CVE-2026-45446', 'CVE-2026-45447']},
    {'osver': '24.04', 'pkgname': 'openssl', 'pkgver': '3.0.13-0ubuntu3.11', 'cves': ['CVE-2026-7383', 'CVE-2026-9076', 'CVE-2026-34180', 'CVE-2026-34182', 'CVE-2026-42766', 'CVE-2026-42767', 'CVE-2026-42770', 'CVE-2026-45445', 'CVE-2026-45446', 'CVE-2026-45447']},
    {'osver': '25.10', 'pkgname': 'libssl-dev', 'pkgver': '3.5.3-1ubuntu3.4', 'cves': ['CVE-2026-7383', 'CVE-2026-9076', 'CVE-2026-34180', 'CVE-2026-34181', 'CVE-2026-34182', 'CVE-2026-34183', 'CVE-2026-42764', 'CVE-2026-42766', 'CVE-2026-42767', 'CVE-2026-42768', 'CVE-2026-42769', 'CVE-2026-42770', 'CVE-2026-45445', 'CVE-2026-45446', 'CVE-2026-45447']},
    {'osver': '25.10', 'pkgname': 'libssl3t64', 'pkgver': '3.5.3-1ubuntu3.4', 'cves': ['CVE-2026-7383', 'CVE-2026-9076', 'CVE-2026-34180', 'CVE-2026-34181', 'CVE-2026-34182', 'CVE-2026-34183', 'CVE-2026-42764', 'CVE-2026-42766', 'CVE-2026-42767', 'CVE-2026-42768', 'CVE-2026-42769', 'CVE-2026-42770', 'CVE-2026-45445', 'CVE-2026-45446', 'CVE-2026-45447']},
    {'osver': '25.10', 'pkgname': 'openssl', 'pkgver': '3.5.3-1ubuntu3.4', 'cves': ['CVE-2026-7383', 'CVE-2026-9076', 'CVE-2026-34180', 'CVE-2026-34181', 'CVE-2026-34182', 'CVE-2026-34183', 'CVE-2026-42764', 'CVE-2026-42766', 'CVE-2026-42767', 'CVE-2026-42768', 'CVE-2026-42769', 'CVE-2026-42770', 'CVE-2026-45445', 'CVE-2026-45446', 'CVE-2026-45447']},
    {'osver': '25.10', 'pkgname': 'openssl-provider-legacy', 'pkgver': '3.5.3-1ubuntu3.4', 'cves': ['CVE-2026-7383', 'CVE-2026-9076', 'CVE-2026-34180', 'CVE-2026-34181', 'CVE-2026-34182', 'CVE-2026-34183', 'CVE-2026-42764', 'CVE-2026-42766', 'CVE-2026-42767', 'CVE-2026-42768', 'CVE-2026-42769', 'CVE-2026-42770', 'CVE-2026-45445', 'CVE-2026-45446', 'CVE-2026-45447']},
    {'osver': '26.04', 'pkgname': 'libssl-dev', 'pkgver': '3.5.5-1ubuntu3.2', 'cves': ['CVE-2026-7383', 'CVE-2026-9076', 'CVE-2026-34180', 'CVE-2026-34181', 'CVE-2026-34182', 'CVE-2026-34183', 'CVE-2026-42764', 'CVE-2026-42766', 'CVE-2026-42767', 'CVE-2026-42768', 'CVE-2026-42769', 'CVE-2026-42770', 'CVE-2026-45445', 'CVE-2026-45446', 'CVE-2026-45447']},
    {'osver': '26.04', 'pkgname': 'libssl3t64', 'pkgver': '3.5.5-1ubuntu3.2', 'cves': ['CVE-2026-7383', 'CVE-2026-9076', 'CVE-2026-34180', 'CVE-2026-34181', 'CVE-2026-34182', 'CVE-2026-34183', 'CVE-2026-42764', 'CVE-2026-42766', 'CVE-2026-42767', 'CVE-2026-42768', 'CVE-2026-42769', 'CVE-2026-42770', 'CVE-2026-45445', 'CVE-2026-45446', 'CVE-2026-45447']},
    {'osver': '26.04', 'pkgname': 'openssl', 'pkgver': '3.5.5-1ubuntu3.2', 'cves': ['CVE-2026-7383', 'CVE-2026-9076', 'CVE-2026-34180', 'CVE-2026-34181', 'CVE-2026-34182', 'CVE-2026-34183', 'CVE-2026-42764', 'CVE-2026-42766', 'CVE-2026-42767', 'CVE-2026-42768', 'CVE-2026-42769', 'CVE-2026-42770', 'CVE-2026-45445', 'CVE-2026-45446', 'CVE-2026-45447']},
    {'osver': '26.04', 'pkgname': 'openssl-provider-legacy', 'pkgver': '3.5.5-1ubuntu3.2', 'cves': ['CVE-2026-7383', 'CVE-2026-9076', 'CVE-2026-34180', 'CVE-2026-34181', 'CVE-2026-34182', 'CVE-2026-34183', 'CVE-2026-42764', 'CVE-2026-42766', 'CVE-2026-42767', 'CVE-2026-42768', 'CVE-2026-42769', 'CVE-2026-42770', 'CVE-2026-45445', 'CVE-2026-45446', 'CVE-2026-45447']}
];

var flag = 0;
foreach var package_array ( pkgs ) {
  var osver = NULL;
  var pkgname = NULL;
  var pkgver = NULL;
  if (!empty_or_null(package_array['osver'])) osver = package_array['osver'];
  if (!empty_or_null(package_array['pkgname'])) pkgname = package_array['pkgname'];
  if (!empty_or_null(package_array['pkgver'])) pkgver = package_array['pkgver'];
  if (!empty_or_null(package_array['cves'])) cves = package_array['cves'];
  if (osver && pkgname && pkgver) {
    if (deb_check(release:osver, prefix:pkgname, reference:pkgver, cves:cves)) flag++;
  }
}

if (flag)
{
  var extra = '';
  extra += ubuntu_report_get();
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : extra
  );
  exit(0);
}
else
{
  var tested = ubuntu_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'libssl-dev / libssl3 / libssl3t64 / openssl / etc');
}