Linux Distros Unpatched Vulnerability : CVE-2026-50221

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(322295);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/24");

  script_cve_id("CVE-2026-50221");

  script_name(english:"Linux Distros Unpatched Vulnerability : CVE-2026-50221");

  script_set_attribute(attribute:"synopsis", value:
"The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be
patched.");
  script_set_attribute(attribute:"description", value:
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied
patch available.

  - In OpenStack Swift before 2.37.2, proxy-server does not strip internal update headers (X-Container-Host,
    X-Container-Device, X-Delete-At-Host, X-Delete-At-Device) from client requests before forwarding them to
    object-servers. An authenticated user with write access can inject these headers to redirect container
    update requests to an attacker-controlled server, enabling server-side request forgery. The SSRF requests
    expose internal cluster metadata including storage policy indexes, partition mappings, device names, and
    when at rest encryption is enabled, cipher text and initialization vectors for the container-level
    encryption key. The attacker can also cause ghost listings in arbitrary containers via the shard-range
    redirect mechanism. (CVE-2026-50221)

Note that Nessus relies on the presence of the package as reported by the vendor.");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-50221");
  script_set_attribute(attribute:"solution", value:
"There is no known solution at this time.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-50221");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"vendor_unpatched", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/23");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/24");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:11.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:12.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:13.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:14.0");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:swift");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl", "set_linux_os_id.nasl");
  script_require_keys("Host/cpu", "Host/local_checks_enabled", "global_settings/vendor_unpatched", "Host/OS/identifier");
  script_require_ports("Host/OS/Debian Linux-11", "Host/OS/Debian Linux-12", "Host/OS/Debian Linux-13", "Host/OS/Debian Linux-14");

  exit(0);
}

if (!get_kb_item("global_settings/vendor_unpatched")) exit(0, "Unpatched Vulnerabilities Detection not active.");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (empty_or_null(get_one_kb_item("Host/Debian/dpkg-l"))) audit(AUDIT_PACKAGE_LIST_MISSING);

include('linux_unpatched.inc');

var distro_constraints_array = {
  "Debian Linux-11": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "11",
        "pkgs": [
          {"reference": "python3-swift"},
          {"reference": "swift"},
          {"reference": "swift-account"},
          {"reference": "swift-container"},
          {"reference": "swift-doc"},
          {"reference": "swift-drive-audit"},
          {"reference": "swift-object"},
          {"reference": "swift-object-expirer"},
          {"reference": "swift-proxy"}
        ]
      }
    ]
  },
  "Debian Linux-12": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "12",
        "pkgs": [
          {"reference": "python3-swift"},
          {"reference": "swift"},
          {"reference": "swift-account"},
          {"reference": "swift-container"},
          {"reference": "swift-doc"},
          {"reference": "swift-drive-audit"},
          {"reference": "swift-object"},
          {"reference": "swift-object-expirer"},
          {"reference": "swift-proxy"}
        ]
      }
    ]
  },
  "Debian Linux-13": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "13",
        "pkgs": [
          {"reference": "python3-swift"},
          {"reference": "swift"},
          {"reference": "swift-account"},
          {"reference": "swift-container"},
          {"reference": "swift-doc"},
          {"reference": "swift-drive-audit"},
          {"reference": "swift-object"},
          {"reference": "swift-object-expirer"},
          {"reference": "swift-proxy"}
        ]
      }
    ]
  },
  "Debian Linux-14": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "14",
        "pkgs": [
          {"reference": "python3-swift"},
          {"reference": "swift"},
          {"reference": "swift-account"},
          {"reference": "swift-container"},
          {"reference": "swift-doc"},
          {"reference": "swift-drive-audit"},
          {"reference": "swift-object"},
          {"reference": "swift-object-expirer"},
          {"reference": "swift-proxy"}
        ]
      }
    ]
  }
};

var distro_constraints_values = linux_unpatched::get_distro_constraints(distro_constraints_arr:distro_constraints_array);
if (empty_or_null(distro_constraints_values)) audit(AUDIT_HOST_NOT, 'affected');
var report = linux_unpatched::check_unpatched_constraints(distro_constraints_values:distro_constraints_values);

if (!empty_or_null(report))
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : report
  );
  exit(0);
}
else
{
  audit(AUDIT_HOST_NOT, 'affected');
}