Linux Distros Unpatched Vulnerability : CVE-2026-63317

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(329693);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/25");

  script_cve_id("CVE-2026-63317");

  script_name(english:"Linux Distros Unpatched Vulnerability : CVE-2026-63317");

  script_set_attribute(attribute:"synopsis", value:
"The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be
patched.");
  script_set_attribute(attribute:"description", value:
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied
patch available.

  - Arbitrary Class Instantiation via XML Feature Generator Descriptor and Format Name in Apache OpenNLP
    Versions Affected: - before 2.5.10 - before 3.0.0-M5 Description: Three code paths in Apache OpenNLP load
    a class by its fully-qualified name via Class.forName() and invoke its no-arg constructor without any
    prior validation of the class name or its type. The affected paths are: (1) GeneratorFactory, which reads
    the class attribute of generator elements in an XML feature generator descriptor; such descriptors are
    embedded as artifacts in model archives (e.g. TokenNameFinder and POSTagger models) and are parsed during
    model loading, so an attacker who can supply a crafted model archive controls the class name directly. (2)
    StreamFactoryRegistry.getFactory(Class, String), which falls back to interpreting an unregistered format
    name as the fully-qualified class name of an ObjectStreamFactory; this is exploitable in applications that
    pass untrusted format names (e.g. exposing the -format parameter of the command-line tooling to external
    input). (3) StringInterners, which instantiates the interner implementation named by the
    opennlp.interner.class system property; this value is normally deployer-controlled, so it is hardened as
    defense in depth rather than being independently attacker-reachable. Exploitation requires a class with
    attacker-useful side effects in its static initializer or no-arg constructor (JNDI lookup, outbound
    network I/O, filesystem access) to be present on the classpath, so this is not drop-in remote code
    execution. T Mitigation: Upgrade to a fixed release. The fix routes all three paths through
    ExtensionLoader.instantiateExtension(...), which consults a package-prefix allowlist before
    Class.forName() is invoked, so a disallowed class is never loaded, initialized, or constructed. Classes
    under the opennlp. prefix remain permitted by default. Deployments that load models referencing feature
    generator factories, object stream factories, or string interners outside opennlp.* must opt those
    packages in, either programmatically via ExtensionLoader.registerAllowedPackage(String) before the first
    model load, or by setting the OPENNLP_EXT_ALLOWED_PACKAGES system property to a comma-separated list of
    allowed package prefixes. Users who cannot upgrade immediately should ensure all model files and format
    names are sourced from trusted origins and should audit their classpath for classes with side-effecting
    static initializers or constructors. (CVE-2026-63317)

Note that Nessus relies on the presence of the package as reported by the vendor.");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-63317");
  script_set_attribute(attribute:"solution", value:
"There is no known solution at this time.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:U/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:U/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-63317");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"vendor_unpatched", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/24");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/25");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:11.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:12.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:13.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:14.0");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:apache-opennlp");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl", "set_linux_os_id.nasl");
  script_require_keys("Host/cpu", "Host/local_checks_enabled", "global_settings/vendor_unpatched", "Host/OS/identifier");
  script_require_ports("Host/OS/Debian Linux-11", "Host/OS/Debian Linux-12", "Host/OS/Debian Linux-13", "Host/OS/Debian Linux-14");

  exit(0);
}

if (!get_kb_item("global_settings/vendor_unpatched")) exit(0, "Unpatched Vulnerabilities Detection not active.");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (empty_or_null(get_one_kb_item("Host/Debian/dpkg-l"))) audit(AUDIT_PACKAGE_LIST_MISSING);

include('linux_unpatched.inc');

var distro_constraints_array = {
  "Debian Linux-11": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "11",
        "pkgs": [
          {"reference": "libapache-opennlp-java"},
          {"reference": "opennlp"}
        ]
      }
    ]
  },
  "Debian Linux-12": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "12",
        "pkgs": [
          {"reference": "libapache-opennlp-java"},
          {"reference": "opennlp"}
        ]
      }
    ]
  },
  "Debian Linux-13": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "13",
        "pkgs": [
          {"reference": "libapache-opennlp-java"},
          {"reference": "opennlp"}
        ]
      }
    ]
  },
  "Debian Linux-14": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "14",
        "pkgs": [
          {"reference": "libapache-opennlp-java"},
          {"reference": "opennlp"}
        ]
      }
    ]
  }
};

var distro_constraints_values = linux_unpatched::get_distro_constraints(distro_constraints_arr:distro_constraints_array);
if (empty_or_null(distro_constraints_values)) audit(AUDIT_HOST_NOT, 'affected');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (!empty_or_null(third_party_support)) {
    var third_party_vendors = distro_constraints_values['third_party'];
    if (!empty_or_null(third_party_vendors)) {
        var vendor;
        foreach vendor (third_party_vendors) {
            if (vendor == third_party_support) exit(0, 'A third party management patch is available for this vulnerability from ' + vendor + '.\n');
        }
    }
}

var report = linux_unpatched::check_unpatched_constraints(distro_constraints_values:distro_constraints_values);

if (!empty_or_null(report))
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : report
  );
  exit(0);
}
else
{
  audit(AUDIT_HOST_NOT, 'affected');
}