Linux Distros Unpatched Vulnerability : CVE-2026-54876

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(332785);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/06");

  script_cve_id("CVE-2026-54876");

  script_name(english:"Linux Distros Unpatched Vulnerability : CVE-2026-54876");

  script_set_attribute(attribute:"synopsis", value:
"The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be
patched.");
  script_set_attribute(attribute:"description", value:
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied
patch available.

  - Issue summary: A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP
    response checking by sending an OCSP response that contains no single response entries. Impact summary: An
    attacker can leak an attacker-tunable amount of memory per TLS handshake in a victim client application. A
    long-running client that repeatedly connects to a malicious server can have its memory exhausted,
    resulting in a Denial of Service. CWE: CWE-401: Missing Release of Memory after Effective Lifetime
    Description: The affected function is called during X.509 certificate chain verification when OCSP
    response checking is enabled with the X509_V_FLAG_OCSP_RESP_CHECK or X509_V_FLAG_OCSP_RESP_CHECK_ALL
    verification flags, for example when a TLS client verifies an OCSP response stapled into the TLS handshake
    by the server. When the received BasicOCSPResponse contains an empty SEQUENCE OF SingleResponse, which is
    permitted on the wire and accepted by the OpenSSL decoder, the OCSP_BASICRESP structure allocated by
    OCSP_response_get1_basic() was not freed because an early return bypassed the cleanup code at the end of
    the function. The amount of memory leaked per handshake can be amplified by the attacker by padding the
    certs field of the BasicOCSPResponse with bogus certificates, which are parsed and stored in the leaked
    structure before the empty response check triggers the early return. A long-running TLS client that
    repeatedly connects to a malicious server can have its memory exhausted over time. OCSP response checking
    is not enabled by default. Only client applications that explicitly enable the OCSP response check
    verification flags are affected. FIPS impact: no The FIPS modules in 4.0 and 3.6 are not affected by this
    issue as the affected code is outside the OpenSSL FIPS module boundary. (CVE-2026-54876)

Note that Nessus relies on the presence of the package as reported by the vendor.");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-54876");
  script_set_attribute(attribute:"see_also", value:"https://ubuntu.com/security/CVE-2026-54876");
  script_set_attribute(attribute:"solution", value:
"There is no known solution at this time.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:U/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:U/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-54876");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"vendor_unpatched", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/05");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/05");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:14.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:16.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:18.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:20.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:22.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:24.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:26.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:14.0");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:edk2");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:nodejs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:openssl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:openssl1.0");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:openssl");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl", "set_linux_os_id.nasl");
  script_require_keys("Host/cpu", "Host/local_checks_enabled", "global_settings/vendor_unpatched", "Host/OS/identifier");
  script_require_ports("Host/OS/Debian Linux-14", "Host/OS/Ubuntu Linux-14.04", "Host/OS/Ubuntu Linux-16.04", "Host/OS/Ubuntu Linux-18.04", "Host/OS/Ubuntu Linux-20.04", "Host/OS/Ubuntu Linux-22.04", "Host/OS/Ubuntu Linux-24.04", "Host/OS/Ubuntu Linux-26.04");

  exit(0);
}

if (!get_kb_item("global_settings/vendor_unpatched")) exit(0, "Unpatched Vulnerabilities Detection not active.");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (empty_or_null(get_one_kb_item("Host/Debian/dpkg-l"))) audit(AUDIT_PACKAGE_LIST_MISSING);

include('linux_unpatched.inc');

var distro_constraints_array = {
  "Debian Linux-14": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "14",
        "pkgs": [
          {"reference": "libcrypto3-udeb"},
          {"reference": "libssl-dev"},
          {"reference": "libssl-doc"},
          {"reference": "libssl3-udeb"},
          {"reference": "libssl3t64"},
          {"reference": "openssl"},
          {"reference": "openssl-provider-fips"},
          {"reference": "openssl-provider-legacy"}
        ]
      }
    ]
  },
  "Ubuntu Linux-14.04": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "14.04",
        "pkgs": [
          {"reference": "libcrypto1.0.0-udeb"},
          {"reference": "libssl-dev"},
          {"reference": "libssl-doc"},
          {"reference": "libssl1.0.0"},
          {"reference": "libssl1.0.0-dbg"},
          {"reference": "libssl1.0.0-udeb"},
          {"reference": "openssl"}
        ]
      }
    ]
  },
  "Ubuntu Linux-16.04": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "16.04",
        "pkgs": [
          {"reference": "edk2"},
          {"reference": "libcrypto1.0.0-udeb"},
          {"reference": "libssl-dev"},
          {"reference": "libssl-doc"},
          {"reference": "libssl1.0.0"},
          {"reference": "libssl1.0.0-dbg"},
          {"reference": "libssl1.0.0-udeb"},
          {"reference": "nodejs"},
          {"reference": "openssl"}
        ]
      }
    ]
  },
  "Ubuntu Linux-18.04": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "18.04",
        "pkgs": [
          {"reference": "edk2"},
          {"reference": "libcrypto1.0.0-udeb"},
          {"reference": "libcrypto1.1-udeb"},
          {"reference": "libssl-dev"},
          {"reference": "libssl-doc"},
          {"reference": "libssl1.0-dev"},
          {"reference": "libssl1.0.0"},
          {"reference": "libssl1.0.0-udeb"},
          {"reference": "libssl1.1"},
          {"reference": "libssl1.1-udeb"},
          {"reference": "nodejs"},
          {"reference": "openssl"},
          {"reference": "openssl1.0"}
        ]
      }
    ]
  },
  "Ubuntu Linux-20.04": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "20.04",
        "pkgs": [
          {"reference": "libcrypto1.1-udeb"},
          {"reference": "libssl-dev"},
          {"reference": "libssl-doc"},
          {"reference": "libssl1.1"},
          {"reference": "libssl1.1-udeb"},
          {"reference": "openssl"},
          {"reference": "ovmf"},
          {"reference": "qemu-efi"},
          {"reference": "qemu-efi-aarch64"},
          {"reference": "qemu-efi-arm"}
        ]
      }
    ]
  },
  "Ubuntu Linux-22.04": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "22.04",
        "pkgs": [
          {"reference": "libcrypto3-udeb"},
          {"reference": "libssl-dev"},
          {"reference": "libssl-doc"},
          {"reference": "libssl3"},
          {"reference": "libssl3-udeb"},
          {"reference": "nodejs"},
          {"reference": "openssl"},
          {"reference": "ovmf"},
          {"reference": "ovmf-ia32"},
          {"reference": "qemu-efi"},
          {"reference": "qemu-efi-aarch64"},
          {"reference": "qemu-efi-arm"}
        ]
      }
    ]
  },
  "Ubuntu Linux-24.04": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "24.04",
        "pkgs": [
          {"reference": "efi-shell-aa64"},
          {"reference": "efi-shell-arm"},
          {"reference": "efi-shell-ia32"},
          {"reference": "efi-shell-riscv64"},
          {"reference": "efi-shell-x64"},
          {"reference": "libcrypto3-udeb"},
          {"reference": "libssl-dev"},
          {"reference": "libssl-doc"},
          {"reference": "libssl3-udeb"},
          {"reference": "libssl3t64"},
          {"reference": "openssl"},
          {"reference": "ovmf"},
          {"reference": "ovmf-ia32"},
          {"reference": "qemu-efi-aarch64"},
          {"reference": "qemu-efi-arm"},
          {"reference": "qemu-efi-riscv64"}
        ]
      }
    ]
  },
  "Ubuntu Linux-26.04": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "26.04",
        "pkgs": [
          {"reference": "efi-shell-aa64"},
          {"reference": "efi-shell-loongarch64"},
          {"reference": "efi-shell-riscv64"},
          {"reference": "efi-shell-x64"},
          {"reference": "libcrypto3-udeb"},
          {"reference": "libssl-dev"},
          {"reference": "libssl-doc"},
          {"reference": "libssl3-udeb"},
          {"reference": "libssl3t64"},
          {"reference": "openssl"},
          {"reference": "openssl-provider-legacy"},
          {"reference": "ovmf"},
          {"reference": "ovmf-amdsev"},
          {"reference": "ovmf-generic"},
          {"reference": "ovmf-inteltdx"},
          {"reference": "ovmf-legacy"},
          {"reference": "qemu-efi-aarch64"},
          {"reference": "qemu-efi-loongarch64"},
          {"reference": "qemu-efi-riscv64"}
        ]
      }
    ]
  }
};

var distro_constraints_values = linux_unpatched::get_distro_constraints(distro_constraints_arr:distro_constraints_array);
if (empty_or_null(distro_constraints_values)) audit(AUDIT_HOST_NOT, 'affected');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (!empty_or_null(third_party_support)) {
    var third_party_vendors = distro_constraints_values['third_party'];
    if (!empty_or_null(third_party_vendors)) {
        var vendor;
        foreach vendor (third_party_vendors) {
            if (vendor == third_party_support) exit(0, 'A third party management patch is available for this vulnerability from ' + vendor + '.\n');
        }
    }
}

var report = linux_unpatched::check_unpatched_constraints(distro_constraints_values:distro_constraints_values);

if (!empty_or_null(report))
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : report
  );
  exit(0);
}
else
{
  audit(AUDIT_HOST_NOT, 'affected');
}