Fedora: Security Advisory for golang-github-burntsushi-toml-test (FEDORA-2022-5ef0bd9a27)

# SPDX-FileCopyrightText: 2022 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.822265");
  script_version("2025-04-24T05:40:01+0000");
  script_tag(name:"cvss_base", value:"5.0");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:P/I:N/A:N");
  script_tag(name:"last_modification", value:"2025-04-24 05:40:01 +0000 (Thu, 24 Apr 2025)");
  script_tag(name:"creation_date", value:"2022-07-31 01:15:34 +0000 (Sun, 31 Jul 2022)");
  script_name("Fedora: Security Advisory for golang-github-burntsushi-toml-test (FEDORA-2022-5ef0bd9a27)");
  script_category(ACT_GATHER_INFO);
  script_copyright("Copyright (C) 2022 Greenbone AG");
  script_family("Fedora Local Security Checks");
  script_dependencies("gather-package-list.nasl");
  script_mandatory_keys("ssh/login/fedora", "ssh/login/rpms", re:"ssh/login/release=FC36");

  script_xref(name:"Advisory-ID", value:"FEDORA-2022-5ef0bd9a27");
  script_xref(name:"URL", value:"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5SUEAV2J7ZZFFSLS5YMGZQNAMMDQ5UUZ");

  script_tag(name:"summary", value:"The remote host is missing an update for the 'golang-github-burntsushi-toml-test'
  package(s) announced via the FEDORA-2022-5ef0bd9a27 advisory.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable package version is present on the target host.");

  script_tag(name:"insight", value:"Toml-test is a higher-order program that tests other TOML decoders or encoders.
The goal is to make it comprehensive. Tests are divided into two groups: invalid
TOML data and valid TOML data. Decoders that reject invalid TOML data pass
invalid TOML tests. Decoders that accept valid TOML data and output precisely
what is expected pass valid tests. The output format is JSON, described below.

Both decoders and encoders share valid tests, except an encoder accepts JSON and
outputs TOML. The TOML representations are read with a blessed decoder and
compared. Note though that encoders have their own set of invalid tests in the
invalid-encoder directory. The JSON given to a TOML encoder is in the same
format as the JSON that a TOML decoder should output.");

  script_tag(name:"affected", value:"'golang-github-burntsushi-toml-test' package(s) on Fedora 36.");

  script_tag(name:"solution", value:"Please install the updated package(s).");

  script_tag(name:"solution_type", value:"VendorFix");
  script_tag(name:"qod_type", value:"package");

  exit(0);
}

include("revisions-lib.inc");
include("pkg-lib-rpm.inc");

release = rpm_get_ssh_release();
if(!release)
  exit(0);

res = "";
report = "";

if(release == "FC36") {

  if(!isnull(res = isrpmvuln(pkg:"golang-github-burntsushi-toml-test", rpm:"golang-github-burntsushi-toml-test~0.2.0~12.20210108git9767d20.fc36", rls:"FC36"))) {
    report += res;
  }

  if(report != "") {
    security_message(data:report);
  } else if(__pkg_match) {
    exit(99);
  }
  exit(0);
}

exit(0);