Linux Distros Unpatched Vulnerability : CVE-2026-71889

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(362876);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/03");

  script_cve_id("CVE-2026-71889");

  script_name(english:"Linux Distros Unpatched Vulnerability : CVE-2026-71889");

  script_set_attribute(attribute:"synopsis", value:
"The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be
patched.");
  script_set_attribute(attribute:"description", value:
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied
patch available.

  - In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathReviewer -
    org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer nor the legacy
    org.bouncycastle.x509.PKIXCertPathReviewer - applied X.509 name constraints to the end-entity certificate.
    checkNameConstraints walked the path with a loop bound of index greater than zero, which is the bound the
    CA-only steps require, but index zero is the target certificate under the standard CertPath ordering, so
    the permitted and excluded subtree checks of RFC 5280 sec. 6.1.3 (b) and (c) never ran against the leaf's
    subject DN or its subjectAltName. A chain whose leaf violated a NameConstraints extension imposed by its
    own issuing CA therefore reported isValidCertPath() true with an empty error list, while
    CertPathValidator.getInstance(PKIX, BC), which shares no code with the reviewer, rejected the
    identical chain against the identical trust anchor. An application using the reviewer to make the trust
    decision rather than for diagnostics alongside a real validation accepted a certificate the constrained CA
    was never authorised to issue. Both copies now check every certificate in the path including the target,
    waive the sec. 4.2.1.10 self-issued exemption for the final certificate as sec. 6.1.3 requires, and skip
    the sec. 6.1.4 (g) constraint-accumulation step for the target. This issue also affects Bouncy Castle for
    Java LTS before 2.73.13, which carries only the org.bouncycastle.pkix.jcajce copy of the reviewer. It also
    affects Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X
    series) and 2.1.13 (2.1.X series). (CVE-2026-71889)

Note that Nessus relies on the presence of the package as reported by the vendor.");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-71889");
  script_set_attribute(attribute:"solution", value:
"There is no known solution at this time.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:U/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:U/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_supplemental", value:"CVSS:4.0/U:Amber");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-71889");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"vendor_unpatched", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/03");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/03");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:12.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:13.0");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:bouncycastle");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl", "set_linux_os_id.nasl");
  script_require_keys("Host/cpu", "Host/local_checks_enabled", "global_settings/vendor_unpatched", "Host/OS/identifier");
  script_require_ports("Host/OS/Debian Linux-12", "Host/OS/Debian Linux-13");

  exit(0);
}

if (!get_kb_item("global_settings/vendor_unpatched")) exit(0, "Unpatched Vulnerabilities Detection not active.");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (empty_or_null(get_one_kb_item("Host/Debian/dpkg-l"))) audit(AUDIT_PACKAGE_LIST_MISSING);

include('linux_unpatched.inc');

var distro_constraints_array = {
  "Debian Linux-12": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "12",
        "pkgs": [
          {"reference": "libbcjmail-java"},
          {"reference": "libbcmail-java"},
          {"reference": "libbcpg-java"},
          {"reference": "libbcpkix-java"},
          {"reference": "libbcprov-java"},
          {"reference": "libbctls-java"},
          {"reference": "libbcutil-java"}
        ]
      }
    ]
  },
  "Debian Linux-13": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "13",
        "pkgs": [
          {"reference": "libbcjmail-java"},
          {"reference": "libbcmail-java"},
          {"reference": "libbcpg-java"},
          {"reference": "libbcpkix-java"},
          {"reference": "libbcprov-java"},
          {"reference": "libbctls-java"},
          {"reference": "libbcutil-java"}
        ]
      }
    ]
  }
};

var distro_constraints_values = linux_unpatched::get_distro_constraints(distro_constraints_arr:distro_constraints_array);
if (empty_or_null(distro_constraints_values)) audit(AUDIT_HOST_NOT, 'affected');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (!empty_or_null(third_party_support)) {
    var third_party_vendors = distro_constraints_values['third_party'];
    if (!empty_or_null(third_party_vendors)) {
        var vendor;
        foreach vendor (third_party_vendors) {
            if (vendor == third_party_support) exit(0, 'A third party management patch is available for this vulnerability from ' + vendor + '.\n');
        }
    }
}

var report = linux_unpatched::check_unpatched_constraints(distro_constraints_values:distro_constraints_values);

if (!empty_or_null(report))
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : report
  );
  exit(0);
}
else
{
  audit(AUDIT_HOST_NOT, 'affected');
}