Linux Distros Unpatched Vulnerability : CVE-2026-105437

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(378549);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/11/12");

  script_cve_id("CVE-2026-105437");

  script_name(english:"Linux Distros Unpatched Vulnerability : CVE-2026-105437");

  script_set_attribute(attribute:"synopsis", value:
"The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be
patched.");
  script_set_attribute(attribute:"description", value:
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied
patch available.

  - Affected versions of Git have a heap buffer overflow in the three-way merge code (xdiff), which an
    attacker can trigger through a repository they control. When Git merges a file, it first adds up the size
    of the merged output, allocates a buffer of that size, and then writes the output into it. That total was
    kept in a 32-bit signed integer. The conflict-marker-size attribute, which can be set from a committed
    .gitattributes file, accepts any positive integer, and the markers are written several times for every
    conflict. A small file with a huge marker size and many separate conflicts can therefore push the total
    past 4 GiB, so the integer wraps to a small value and Git writes attacker-controlled merge output past the
    end of a buffer that is too small. At minimum this crashes Git, and because the overflow is large and its
    contents are largely attacker-controlled, worse heap corruption is possible. Any command that does a
    textual three-way merge can trigger it, such as git-merge(1), git-rebase(1), git-cherry-pick(1), and git-
    merge-tree(1). The latter is most likely a target for Git forges, which might use git-merge-tree(1) on the
    server-side to check mergeability. When the server reads attributes from trees in the repository (for
    example through attr.tree or --attr-source), any user who can push branches and request that they be
    merged (for example by opening a pull or merge request) can trigger the overflow without anyone else doing
    anything, and the data they push is small because the oversized output only appears during the merge. The
    problem has been patched by computing the size as size_t and checking every addition for overflow, so Git
    stops with an error instead of overflowing. Servers that cannot upgrade right away can add * conflict-
    marker-size=7 to each repository's info/attributes as a workaround, which overrides any in-tree
    .gitattributes, or turn off server-side mergeability checks for untrusted repositories. (CVE-2026-105437)

Note that Nessus relies on the presence of the package as reported by the vendor.");
  script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2026-105437");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-105437");
  script_set_attribute(attribute:"solution", value:
"There is no known solution at this time.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:U/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:U/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-105437");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"vendor_unpatched", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/11/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/11/10");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:redhat:enterprise_linux:10");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:redhat:enterprise_linux:8");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:redhat:enterprise_linux:9");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:centos:centos:8");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:12.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:13.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:14.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:10");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:8");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:9");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:git");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:git-all");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:git-core");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:git-core-doc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:git-credential-libsecret");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:git-daemon");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:git-email");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:git-gui");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:git-instaweb");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:git-subtree");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:git-svn");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:gitk");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:gitweb");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:perl-Git");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:perl-Git-SVN");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:git");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:git");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:git-all");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:git-core");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:git-core-doc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:git-credential-libsecret");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:git-daemon");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:git-email");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:git-gui");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:git-instaweb");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:git-subtree");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:git-svn");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:gitk");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:gitweb");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:perl-Git");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:perl-Git-SVN");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl", "set_linux_os_id.nasl");
  script_require_keys("Host/cpu", "Host/local_checks_enabled", "global_settings/vendor_unpatched", "Host/OS/identifier");
  script_require_ports("Host/OS/CentOS Linux-8", "Host/OS/Debian Linux-12", "Host/OS/Debian Linux-13", "Host/OS/Debian Linux-14", "Host/OS/Red Hat Enterprise Linux-10", "Host/OS/Red Hat Enterprise Linux-8", "Host/OS/Red Hat Enterprise Linux-9");

  exit(0);
}

if (!get_kb_item("global_settings/vendor_unpatched")) exit(0, "Unpatched Vulnerabilities Detection not active.");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (empty_or_null(get_one_kb_item("Host/CentOS/rpm-list")) && empty_or_null(get_one_kb_item("Host/Debian/dpkg-l")) && empty_or_null(get_one_kb_item("Host/RedHat/rpm-list"))) audit(AUDIT_PACKAGE_LIST_MISSING);

include('linux_unpatched.inc');

var distro_constraints_array = {
  "Debian Linux-12": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "12",
        "pkgs": [
          {"reference": "git"},
          {"reference": "git-all"},
          {"reference": "git-cvs"},
          {"reference": "git-daemon-run"},
          {"reference": "git-daemon-sysvinit"},
          {"reference": "git-doc"},
          {"reference": "git-email"},
          {"reference": "git-gui"},
          {"reference": "git-man"},
          {"reference": "git-mediawiki"},
          {"reference": "git-svn"},
          {"reference": "gitk"},
          {"reference": "gitweb"}
        ]
      }
    ]
  },
  "Debian Linux-14": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "14",
        "pkgs": [
          {"reference": "git"},
          {"reference": "git-all"},
          {"reference": "git-cvs"},
          {"reference": "git-doc"},
          {"reference": "git-email"},
          {"reference": "git-gui"},
          {"reference": "git-man"},
          {"reference": "git-svn"},
          {"reference": "gitk"},
          {"reference": "gitweb"}
        ]
      }
    ]
  },
  "Debian Linux-13": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "13",
        "pkgs": [
          {"reference": "git"},
          {"reference": "git-all"},
          {"reference": "git-cvs"},
          {"reference": "git-doc"},
          {"reference": "git-email"},
          {"reference": "git-gui"},
          {"reference": "git-man"},
          {"reference": "git-mediawiki"},
          {"reference": "git-svn"},
          {"reference": "gitk"},
          {"reference": "gitweb"}
        ]
      }
    ]
  },
  "Red Hat Enterprise Linux-10": {
    "package_manager": "rpm-list",
    "constraints": [
      {
        "release": "10",
        "pkgs": [
          {"reference": "git"}
        ]
      }
    ]
  },
  "CentOS Linux-8": {
    "package_manager": "rpm-list",
    "constraints": [
      {
        "release": "8",
        "pkgs": [
          {"reference": "git"},
          {"reference": "git-all"},
          {"reference": "git-core"},
          {"reference": "git-core-doc"},
          {"reference": "git-credential-libsecret"},
          {"reference": "git-daemon"},
          {"reference": "git-email"},
          {"reference": "git-gui"},
          {"reference": "git-instaweb"},
          {"reference": "git-subtree"},
          {"reference": "git-svn"},
          {"reference": "gitk"},
          {"reference": "gitweb"},
          {"reference": "perl-Git"},
          {"reference": "perl-Git-SVN"}
        ]
      }
    ]
  },
  "Red Hat Enterprise Linux-8": {
    "package_manager": "rpm-list",
    "constraints": [
      {
        "release": "8",
        "pkgs": [
          {"reference": "git"},
          {"reference": "git-all"},
          {"reference": "git-core"},
          {"reference": "git-core-doc"},
          {"reference": "git-credential-libsecret"},
          {"reference": "git-daemon"},
          {"reference": "git-email"},
          {"reference": "git-gui"},
          {"reference": "git-instaweb"},
          {"reference": "git-subtree"},
          {"reference": "git-svn"},
          {"reference": "gitk"},
          {"reference": "gitweb"},
          {"reference": "perl-Git"},
          {"reference": "perl-Git-SVN"}
        ]
      }
    ]
  },
  "Red Hat Enterprise Linux-9": {
    "package_manager": "rpm-list",
    "constraints": [
      {
        "release": "9",
        "pkgs": [
          {"reference": "git"},
          {"reference": "git-all"},
          {"reference": "git-core"},
          {"reference": "git-core-doc"},
          {"reference": "git-credential-libsecret"},
          {"reference": "git-daemon"},
          {"reference": "git-email"},
          {"reference": "git-gui"},
          {"reference": "git-instaweb"},
          {"reference": "git-subtree"},
          {"reference": "git-svn"},
          {"reference": "gitk"},
          {"reference": "gitweb"},
          {"reference": "perl-Git"},
          {"reference": "perl-Git-SVN"}
        ]
      }
    ]
  }
};

var distro_constraints_values = linux_unpatched::get_distro_constraints(distro_constraints_arr:distro_constraints_array);
if (empty_or_null(distro_constraints_values)) audit(AUDIT_HOST_NOT, 'affected');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (!empty_or_null(third_party_support)) {
    var third_party_vendors = distro_constraints_values['third_party'];
    if (!empty_or_null(third_party_vendors)) {
        var vendor;
        foreach vendor (third_party_vendors) {
            if (vendor == third_party_support) exit(0, 'A third party management patch is available for this vulnerability from ' + vendor + '.\n');
        }
    }
}

var report = linux_unpatched::check_unpatched_constraints(distro_constraints_values:distro_constraints_values);

if (!empty_or_null(report))
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : report
  );
  exit(0);
}
else
{
  audit(AUDIT_HOST_NOT, 'affected');
}