SUSE SLES15 : Important security update for SUSE Manager Client Tools (SUSE-SU-2022:3178-1)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The package checks in this plugin were extracted from
# SUSE update advisory SUSE-SU-2022:3178-1. The text itself
# is copyright (C) SUSE.
##

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(164906);
  script_version("1.7");
  script_set_attribute(attribute:"plugin_modification_date", value:"2023/07/14");

  script_cve_id(
    "CVE-2021-3447",
    "CVE-2021-3583",
    "CVE-2021-3620",
    "CVE-2021-20178",
    "CVE-2021-20180",
    "CVE-2021-20191",
    "CVE-2021-20228"
  );
  script_xref(name:"SuSE", value:"SUSE-SU-2022:3178-1");

  script_name(english:"SUSE SLES15 : Important security update for SUSE Manager Client Tools (SUSE-SU-2022:3178-1)");

  script_set_attribute(attribute:"synopsis", value:
"The remote SUSE host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as
referenced in the SUSE-SU-2022:3178-1 advisory.

  - A flaw was found in ansible module where credentials are disclosed in the console log by default and not
    protected by the security feature when using the bitbucket_pipeline_variable module. This flaw allows an
    attacker to steal bitbucket_pipeline credentials. The highest threat from this vulnerability is to
    confidentiality. (CVE-2021-20178, CVE-2021-20180)

  - A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default
    and not protected by no_log feature when using those modules. An attacker can take advantage of this
    information to steal those credentials. The highest threat from this vulnerability is to data
    confidentiality. Versions before ansible 2.9.18 are affected. (CVE-2021-20191)

  - A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not
    protected by the no_log feature when using the sub-option feature of the basic.py module. This flaw allows
    an attacker to obtain sensitive information. The highest threat from this vulnerability is to
    confidentiality. (CVE-2021-20228)

  - A flaw was found in several ansible modules, where parameters containing credentials, such as secrets,
    were being logged in plain-text on managed nodes, as well as being made visible on the controller node
    when run in verbose mode. These parameters were not protected by the no_log feature. An attacker can take
    advantage of this information to steal those credentials, provided when they have access to the log files
    containing them. The highest threat from this vulnerability is to data confidentiality. This flaw affects
    Red Hat Ansible Automation Platform in versions before 1.2.2 and Ansible Tower in versions before 3.8.2.
    (CVE-2021-3447)

  - A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can
    occur through facts used in the template if the user is trying to put templates in multi-line YAML strings
    and the facts being handled do not routinely include special template characters. This flaw allows
    attackers to perform command injection, which discloses sensitive information. The highest threat from
    this vulnerability is to confidentiality and integrity. (CVE-2021-3583)

  - A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the
    Ansible user credentials is disclosed by default in the traceback error message. The highest threat from
    this vulnerability is to confidentiality. (CVE-2021-3620)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1176460");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1180816");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1180942");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1181119");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1181935");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1183684");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1187725");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1188061");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1193585");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1197963");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1199528");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1200142");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1200591");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1200968");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1200970");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1201003");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1202614");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2021-20178");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2021-20180");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2021-20191");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2021-20228");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2021-3447");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2021-3583");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2021-3620");
  # https://lists.suse.com/pipermail/sle-security-updates/2022-September/012182.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c54d0010");
  script_set_attribute(attribute:"solution", value:
"Update the affected golang-github-prometheus-node_exporter package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2021-20228");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2021/02/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2022/09/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2022/09/09");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:golang-github-prometheus-node_exporter");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:15");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"SuSE Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2022-2023 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include('rpm.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item("Host/SuSE/release");
if (isnull(os_release) || os_release !~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "SUSE");
var os_ver = pregmatch(pattern: "^(SLE(S|D)(?:_SAP)?\d+)", string:os_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'SUSE');
os_ver = os_ver[1];
if (! preg(pattern:"^(SLES15|SLES_SAP15)$", string:os_ver)) audit(AUDIT_OS_NOT, 'SUSE SLES15 / SLES_SAP15', 'SUSE (' + os_ver + ')');

if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'SUSE (' + os_ver + ')', cpu);

var service_pack = get_kb_item("Host/SuSE/patchlevel");
if (isnull(service_pack)) service_pack = "0";
if (os_ver == "SLES15" && (! preg(pattern:"^(0)$", string:service_pack))) audit(AUDIT_OS_NOT, "SLES15 SP0", os_ver + " SP" + service_pack);
if (os_ver == "SLES_SAP15" && (! preg(pattern:"^(0)$", string:service_pack))) audit(AUDIT_OS_NOT, "SLES_SAP15 SP0", os_ver + " SP" + service_pack);

var pkgs = [
    {'reference':'golang-github-prometheus-node_exporter-1.3.0-150000.3.15.1', 'sp':'0', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15']},
    {'reference':'golang-github-prometheus-node_exporter-1.3.0-150000.3.15.1', 'sp':'0', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},
    {'reference':'golang-github-prometheus-node_exporter-1.3.0-150000.3.15.1', 'sp':'0', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},
    {'reference':'golang-github-prometheus-node_exporter-1.3.0-150000.3.15.1', 'sp':'0', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},
    {'reference':'golang-github-prometheus-node_exporter-1.3.0-150000.3.15.1', 'sp':'0', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-15', 'SLE_HPC-LTSS-release-15']},
    {'reference':'golang-github-prometheus-node_exporter-1.3.0-150000.3.15.1', 'sp':'0', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-ltss-release-15']}
];

var ltss_caveat_required = FALSE;
var flag = 0;
foreach var package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var sp = NULL;
  var _cpu = NULL;
  var exists_check = NULL;
  var rpm_spec_vers_cmp = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
  if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
  if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (reference && _release) {
    if (exists_check) {
      var check_flag = 0;
      foreach var check (exists_check) {
        if (!rpm_exists(release:_release, rpm:check)) continue;
        if ('ltss' >< tolower(check)) ltss_caveat_required = TRUE;
        check_flag++;
      }
      if (!check_flag) continue;
    }
    if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, rpm_spec_vers_cmp:rpm_spec_vers_cmp)) flag++;
  }
}

if (flag)
{
  var ltss_plugin_caveat = NULL;
  if(ltss_caveat_required) ltss_plugin_caveat = '\n' +
    'NOTE: This vulnerability check contains fixes that apply to\n' +
    'packages only available in SUSE Enterprise Linux Server LTSS\n' +
    'repositories. Access to these package security updates require\n' +
    'a paid SUSE LTSS subscription.\n';
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get() + ltss_plugin_caveat
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'golang-github-prometheus-node_exporter');
}