Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: libevent (UTSA-2026-124537)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(349889);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/24");

  script_cve_id("CVE-2026-63382");

  script_name(english:"Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: libevent (UTSA-2026-124537)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-124537 advisory.

    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in
    http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding
    values, and bare line feeds in chunked framing. evhttp_find_header can select only the first header,
    evhttp_check_transfer_encoding_ was absent so the previous whole-string comparison fails to recognize
    valid lists ending in chunked, and evhttp_handle_chunked_read uses EVBUFFER_EOL_CRLF rather than
    EVBUFFER_EOL_CRLF_STRICT, accepting bare LF chunk terminators. When libevent is deployed behind a proxy
    that frames the same request differently, an unauthenticated remote attacker can desynchronize request
    boundaries and smuggle a second request, potentially bypassing access controls or poisoning caches. This
    issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-124537
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?16f87941");
  script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/security/cve/CVE-2026-63382");
  # https://github.com/libevent/libevent/commit/10abb34b8dc3e1184de315dd261ce4b77563cda6
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e8814845");
  # https://github.com/libevent/libevent/commit/5119ceb00557bf007f9065709e852686f3c0bb6e
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?6ea8c818");
  # https://github.com/libevent/libevent/commit/83ba67373032334559b82409db035dd8c3cc1660
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8432cbe8");
  # https://github.com/libevent/libevent/commit/ac38703b2d312200c4f967f02936af0118d384a0
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?62981726");
  # https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c125ce75");
  script_set_attribute(attribute:"see_also", value:"https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha");
  # https://github.com/libevent/libevent/security/advisories/GHSA-q39v-w2g7-gr8j
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?71a665ce");
  script_set_attribute(attribute:"solution", value:
"Update the affected libevent package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-63382");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/24");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^(20.1050a|20.1060a|20.1070a)([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050a / 20.1060a / 20.1070a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'loongarch64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050a',
    'pkgs': [
      {'reference':'libevent-2.1.12-7.uelc20.01', 'sp':'1050a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libevent-2.1.12-7.uelc20.01', 'sp':'1050a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libevent-2.1.12-7.uelc20.01', 'sp':'1050a', 'cpu':'loongarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libevent-2.1.12-7.uelc20.01', 'sp':'1050a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  },
  {
    'release': '20',
    'sp': '1060a',
    'pkgs': [
      {'reference':'libevent-2.1.12-7.uelc20.01', 'sp':'1060a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libevent-2.1.12-7.uelc20.01', 'sp':'1060a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libevent-2.1.12-7.uelc20.01', 'sp':'1060a', 'cpu':'loongarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libevent-2.1.12-7.uelc20.01', 'sp':'1060a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  },
  {
    'release': '20',
    'sp': '1070a',
    'pkgs': [
      {'reference':'libevent-2.1.12-7.uelc20.01', 'sp':'1070a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libevent-2.1.12-7.uelc20.01', 'sp':'1070a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libevent-2.1.12-7.uelc20.01', 'sp':'1070a', 'cpu':'loongarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libevent-2.1.12-7.uelc20.01', 'sp':'1070a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'libevent');
}