Linux Distros Unpatched Vulnerability : CVE-2026-121949

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(377115);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/11/07");

  script_cve_id("CVE-2026-121949");

  script_name(english:"Linux Distros Unpatched Vulnerability : CVE-2026-121949");

  script_set_attribute(attribute:"synopsis", value:
"The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be
patched.");
  script_set_attribute(attribute:"description", value:
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied
patch available.

  - The Symfony HtmlSanitizer component does not apply the media URL policy to the srcset and imagesrcset
    attributes, allowing values that point to hosts or schemes not permitted by allowMediaSchemes() or
    allowMediaHosts() to bypass it, so that browsers load images from disallowed hosts in Symfony versions
    6.1.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.The srcset attribute on img and source
    elements and the imagesrcset attribute on link elements are allowed by the sanitizer, but their URL
    candidates are never validated, so their values are kept verbatim while the same URL in src is dropped.
    The fixes for CVE-2026-45753 and CVE-2026-48761 extended the same attribute list but did not cover these
    two attributes. For example, with allowMediaSchemes(['https']) and allowMediaHosts(['trusted.example']),
    <img srcset=https://evil.example/a.png 1x> survives sanitization, and the browser fetches the selected
    candidate as it would fetch src. Candidates with a scheme forbidden by the configuration, such as http,
    are kept as well. Any application that sanitizes untrusted HTML and relies on the media schemes and hosts
    allowlists to restrict where images can be loaded from is affected. A single crafted value is enough to
    make the browser of a user viewing the sanitized content send a request to an attacker-controlled host,
    which can be used to track viewers or log their IP addresses. No authentication is needed if the
    application accepts HTML from unauthenticated users. (CVE-2026-121949)

Note that Nessus relies on the presence of the package as reported by the vendor.");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-121949");
  script_set_attribute(attribute:"see_also", value:"https://ubuntu.com/security/CVE-2026-121949");
  script_set_attribute(attribute:"solution", value:
"There is no known solution at this time.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:U/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:U/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-121949");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"vendor_unpatched", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/11/05");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/11/06");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:16.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:18.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:20.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:22.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:24.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:26.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:26.10");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:12.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:13.0");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:symfony");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:symfony");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl", "set_linux_os_id.nasl");
  script_require_keys("Host/cpu", "Host/local_checks_enabled", "global_settings/vendor_unpatched", "Host/OS/identifier");
  script_require_ports("Host/OS/Debian Linux-12", "Host/OS/Debian Linux-13", "Host/OS/Ubuntu Linux-16.04", "Host/OS/Ubuntu Linux-18.04", "Host/OS/Ubuntu Linux-20.04", "Host/OS/Ubuntu Linux-22.04", "Host/OS/Ubuntu Linux-24.04", "Host/OS/Ubuntu Linux-26.04", "Host/OS/Ubuntu Linux-26.10");

  exit(0);
}

if (!get_kb_item("global_settings/vendor_unpatched")) exit(0, "Unpatched Vulnerabilities Detection not active.");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (empty_or_null(get_one_kb_item("Host/Debian/dpkg-l"))) audit(AUDIT_PACKAGE_LIST_MISSING);

include('linux_unpatched.inc');

var distro_constraints_array = {
  "Debian Linux-12": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "12",
        "pkgs": [
          {"reference": "php-symfony"},
          {"reference": "php-symfony-asset"},
          {"reference": "php-symfony-browser-kit"},
          {"reference": "php-symfony-cache"},
          {"reference": "php-symfony-config"},
          {"reference": "php-symfony-console"},
          {"reference": "php-symfony-css-selector"},
          {"reference": "php-symfony-dependency-injection"},
          {"reference": "php-symfony-dom-crawler"},
          {"reference": "php-symfony-dotenv"},
          {"reference": "php-symfony-error-handler"},
          {"reference": "php-symfony-event-dispatcher"},
          {"reference": "php-symfony-expression-language"},
          {"reference": "php-symfony-filesystem"},
          {"reference": "php-symfony-finder"},
          {"reference": "php-symfony-form"},
          {"reference": "php-symfony-http-client"},
          {"reference": "php-symfony-http-foundation"},
          {"reference": "php-symfony-http-kernel"},
          {"reference": "php-symfony-inflector"},
          {"reference": "php-symfony-intl"},
          {"reference": "php-symfony-ldap"},
          {"reference": "php-symfony-lock"},
          {"reference": "php-symfony-mailer"},
          {"reference": "php-symfony-messenger"},
          {"reference": "php-symfony-mime"},
          {"reference": "php-symfony-notifier"},
          {"reference": "php-symfony-options-resolver"},
          {"reference": "php-symfony-password-hasher"},
          {"reference": "php-symfony-process"},
          {"reference": "php-symfony-property-access"},
          {"reference": "php-symfony-property-info"},
          {"reference": "php-symfony-rate-limiter"},
          {"reference": "php-symfony-routing"},
          {"reference": "php-symfony-runtime"},
          {"reference": "php-symfony-security-core"},
          {"reference": "php-symfony-security-csrf"},
          {"reference": "php-symfony-security-guard"},
          {"reference": "php-symfony-security-http"},
          {"reference": "php-symfony-semaphore"},
          {"reference": "php-symfony-serializer"}
        ]
      }
    ]
  },
  "Debian Linux-13": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "13",
        "pkgs": [
          {"reference": "php-symfony"},
          {"reference": "php-symfony-asset"},
          {"reference": "php-symfony-asset-mapper"},
          {"reference": "php-symfony-browser-kit"},
          {"reference": "php-symfony-cache"},
          {"reference": "php-symfony-clock"},
          {"reference": "php-symfony-config"},
          {"reference": "php-symfony-console"},
          {"reference": "php-symfony-css-selector"},
          {"reference": "php-symfony-dependency-injection"},
          {"reference": "php-symfony-dom-crawler"},
          {"reference": "php-symfony-dotenv"},
          {"reference": "php-symfony-error-handler"},
          {"reference": "php-symfony-event-dispatcher"},
          {"reference": "php-symfony-expression-language"},
          {"reference": "php-symfony-filesystem"},
          {"reference": "php-symfony-finder"},
          {"reference": "php-symfony-form"},
          {"reference": "php-symfony-html-sanitizer"},
          {"reference": "php-symfony-http-client"},
          {"reference": "php-symfony-http-foundation"},
          {"reference": "php-symfony-http-kernel"},
          {"reference": "php-symfony-intl"},
          {"reference": "php-symfony-ldap"},
          {"reference": "php-symfony-lock"},
          {"reference": "php-symfony-mailer"},
          {"reference": "php-symfony-messenger"},
          {"reference": "php-symfony-mime"},
          {"reference": "php-symfony-notifier"},
          {"reference": "php-symfony-options-resolver"},
          {"reference": "php-symfony-password-hasher"},
          {"reference": "php-symfony-process"},
          {"reference": "php-symfony-property-access"},
          {"reference": "php-symfony-property-info"},
          {"reference": "php-symfony-rate-limiter"},
          {"reference": "php-symfony-remote-event"},
          {"reference": "php-symfony-routing"},
          {"reference": "php-symfony-runtime"},
          {"reference": "php-symfony-scheduler"},
          {"reference": "php-symfony-security-core"},
          {"reference": "php-symfony-security-csrf"}
        ]
      }
    ]
  },
  "Ubuntu Linux-16.04": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "16.04",
        "pkgs": [
          {"reference": "symfony"}
        ]
      }
    ]
  },
  "Ubuntu Linux-18.04": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "18.04",
        "pkgs": [
          {"reference": "symfony"}
        ]
      }
    ]
  },
  "Ubuntu Linux-20.04": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "20.04",
        "pkgs": [
          {"reference": "symfony"}
        ]
      }
    ]
  },
  "Ubuntu Linux-22.04": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "22.04",
        "pkgs": [
          {"reference": "symfony"}
        ]
      }
    ]
  },
  "Ubuntu Linux-24.04": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "24.04",
        "pkgs": [
          {"reference": "symfony"}
        ]
      }
    ]
  },
  "Ubuntu Linux-26.04": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "26.04",
        "pkgs": [
          {"reference": "symfony"}
        ]
      }
    ]
  },
  "Ubuntu Linux-26.10": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "26.10",
        "pkgs": [
          {"reference": "symfony"}
        ]
      }
    ]
  }
};

var distro_constraints_values = linux_unpatched::get_distro_constraints(distro_constraints_arr:distro_constraints_array);
if (empty_or_null(distro_constraints_values)) audit(AUDIT_HOST_NOT, 'affected');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (!empty_or_null(third_party_support)) {
    var third_party_vendors = distro_constraints_values['third_party'];
    if (!empty_or_null(third_party_vendors)) {
        var vendor;
        foreach vendor (third_party_vendors) {
            if (vendor == third_party_support) exit(0, 'A third party management patch is available for this vulnerability from ' + vendor + '.\n');
        }
    }
}

var report = linux_unpatched::check_unpatched_constraints(distro_constraints_values:distro_constraints_values);

if (!empty_or_null(report))
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : report
  );
  exit(0);
}
else
{
  audit(AUDIT_HOST_NOT, 'affected');
}