Ubuntu 18.04 LTS / 26.04 LTS : python-cryptography vulnerabilities (USN-8776-1)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Ubuntu Security Notice USN-8776-1. The text
# itself is copyright (C) Canonical, Inc. See
# <https://ubuntu.com/security/notices>. Ubuntu(R) is a registered
# trademark of Canonical, Inc.
##

include('compat.inc');

if (description)
{
  script_id(346812);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/25");

  script_cve_id(
    "CVE-2023-23931",
    "CVE-2026-69247",
    "CVE-2026-69248",
    "CVE-2026-69249"
  );
  script_xref(name:"USN", value:"8776-1");

  script_name(english:"Ubuntu 18.04 LTS / 26.04 LTS : python-cryptography vulnerabilities (USN-8776-1)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Ubuntu host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote Ubuntu 18.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as
referenced in the USN-8776-1 advisory.

    It was discovered that python-cryptography incorrectly accepted objects with immutable buffers when
    performing certain cipher operations. This would result in corrupted output, contrary to expectations.
    This issue only affected Ubuntu 18.04 LTS. (CVE-2023-23931)

    It was discovered that python-cryptography reported the outcome of decrypting PKCS#7 enveloped data in
    distinguishable ways, and with observable timing differences. A remote attacker could possibly use this
    issue to recover the key used to encrypt the message contents, and obtain sensitive information. This
    issue only affected Ubuntu 26.04 LTS. (CVE-2026-69247)

    Jack Lloyd discovered that python-cryptography incorrectly handled wildcard DNS names when enforcing the
    name constraints of a certificate authority. A remote attacker could possibly use this issue to have an
    invalid certificate chain accepted, and use names outside of the permitted ones. This issue only affected
    Ubuntu 26.04 LTS. (CVE-2026-69248)

    Samuel Judson discovered that python-cryptography incorrectly handled certificate chains that contained
    duplicate certificates. A remote attacker could possibly use this issue to cause python-cryptography to
    use excessive resources, leading to a denial of service. This issue only affected Ubuntu 26.04 LTS.
    (CVE-2026-69249)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://ubuntu.com/security/notices/USN-8776-1");
  script_set_attribute(attribute:"solution", value:
"Update the affected python-cryptography and / or python3-cryptography packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-23931");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-69249");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/16");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/17");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:18.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:26.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:python-cryptography");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:python3-cryptography");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Ubuntu Local Security Checks");

  script_copyright(english:"Ubuntu Security Notice (C) 2026 Canonical, Inc. / NASL script (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");

  exit(0);
}

include('debian_package.inc');

if ( ! get_kb_item('Host/local_checks_enabled') ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/Ubuntu/release');
if ( isnull(os_release) ) audit(AUDIT_OS_NOT, 'Ubuntu');
os_release = chomp(os_release);
if (! ('18.04' >< os_release || '26.04' >< os_release)) audit(AUDIT_OS_NOT, 'Ubuntu 18.04 / 26.04', 'Ubuntu ' + os_release);
if ( ! get_kb_item('Host/Debian/dpkg-l') ) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Ubuntu', cpu);

var pkgs = [
    {'osver': '18.04', 'pkgname': 'python-cryptography', 'pkgver': '2.1.4-1ubuntu1.4+esm6', 'cves': ['CVE-2023-23931']},
    {'osver': '18.04', 'pkgname': 'python3-cryptography', 'pkgver': '2.1.4-1ubuntu1.4+esm6', 'cves': ['CVE-2023-23931']},
    {'osver': '26.04', 'pkgname': 'python3-cryptography', 'pkgver': '46.0.5-1ubuntu2.2', 'cves': ['CVE-2026-69247', 'CVE-2026-69248', 'CVE-2026-69249']}
];

var flag = 0;
foreach var package_array ( pkgs ) {
  var osver = NULL;
  var pkgname = NULL;
  var pkgver = NULL;
  if (!empty_or_null(package_array['osver'])) osver = package_array['osver'];
  if (!empty_or_null(package_array['pkgname'])) pkgname = package_array['pkgname'];
  if (!empty_or_null(package_array['pkgver'])) pkgver = package_array['pkgver'];
  if (!empty_or_null(package_array['cves'])) cves = package_array['cves'];
  if (osver && pkgname && pkgver) {
    if (deb_check(release:osver, prefix:pkgname, reference:pkgver, cves:cves)) flag++;
  }
}

if (flag)
{
  var extra = '';
  extra += ubuntu_report_get();
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : extra
  );
  exit(0);
}
else
{
  var tested = ubuntu_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'python-cryptography / python3-cryptography');
}