Emit error for wrong arg order in nasl_functions.

[Tehforsch]

Jira: SC-1163.

I also fixed places where the arguments were not properly ordered. While doing so, I noticed that a few nasl_functions mention nonexistent args in the attrs of the macro. I turned this into a hard error, since it can lead to problems such as in scanner_add_port.

[github-actions]

🔍 Vulnerabilities of harbor-os.greenbone.net/community/openvas-scanner:pr-1721

📦 Image Reference harbor-os.greenbone.net/community/openvas-scanner:pr-1721

digest	sha256:dd657605240940003b8713163926de0950c0ab3e5f0746d996075c3a736cf094
vulnerabilities
size	140 MB
packages	261

📦 Base Image greenbone/gvm-libs:edge

digest	sha256:c775bdcc28b9893cb03ba3e806e6c56b9ba3a7b3344d54ff0044fd065cca71c3
vulnerabilities

nghttp2 1.52.0-1+deb12u1 (deb) pkg:deb/debian/nghttp2@1.52.0-1%2Bdeb12u1?os_distro=bookworm&os_name=debian&os_version=12 Affected range >=1.52.0-1+deb12u1 Fixed version Not Fixed EPSS Score 0.04% EPSS Percentile 14th percentile Description nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK stream. nghttp2 v1.61.0 mitigates this vulnerability by limiting the number of CONTINUATION frames it accepts per stream. There is no workaround for this vulnerability.

pcre3 2:8.39-15 (deb) pkg:deb/debian/pcre3@2:8.39-15?os_distro=bookworm&os_name=debian&os_version=12 Affected range >=2:8.39-15 Fixed version Not Fixed EPSS Score 1.03% EPSS Percentile 84th percentile Description libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \X or \R has more than one fixed quantifier, a related issue to CVE-2019-20454. Affected range >=2:8.39-15 Fixed version Not Fixed EPSS Score 0.65% EPSS Percentile 80th percentile Description Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 268) or possibly have unspecified other impact via a crafted file. Affected range >=2:8.39-15 Fixed version Not Fixed EPSS Score 0.65% EPSS Percentile 80th percentile Description Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 4) or possibly have unspecified other impact via a crafted file. Affected range >=2:8.39-15 Fixed version Not Fixed EPSS Score 0.08% EPSS Percentile 36th percentile Description In PCRE 8.41, after compiling, a pcretest load test PoC produces a crash overflow in the function match() in pcre_exec.c because of a self-recursive call. NOTE: third parties dispute the relevance of this report, noting that there are options that can be used to limit the amount of stack that is used Affected range >=2:8.39-15 Fixed version Not Fixed EPSS Score 0.37% EPSS Percentile 73rd percentile Description In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression.

openldap 2.5.13+dfsg-5 (deb) pkg:deb/debian/openldap@2.5.13%2Bdfsg-5?os_distro=bookworm&os_name=debian&os_version=12 Affected range >=2.5.13+dfsg-5 Fixed version Not Fixed EPSS Score 0.16% EPSS Percentile 54th percentile Description libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux. Affected range >=2.5.13+dfsg-5 Fixed version Not Fixed EPSS Score 0.41% EPSS Percentile 74th percentile Description contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation. Affected range >=2.5.13+dfsg-5 Fixed version Not Fixed EPSS Score 0.04% EPSS Percentile 10th percentile Description slapd in OpenLDAP 2.4.45 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill cat /pathname" command, as demonstrated by openldap-initscript. Affected range >=2.5.13+dfsg-5 Fixed version Not Fixed EPSS Score 0.42% EPSS Percentile 75th percentile Description The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors.

openssl 3.0.13-1~deb12u1 (deb) pkg:deb/debian/openssl@3.0.13-1~deb12u1?os_distro=bookworm&os_name=debian&os_version=12 Affected range <3.0.14-1~deb12u2 Fixed version 3.0.14-1~deb12u2 EPSS Score 0.04% EPSS Percentile 16th percentile Description Issue summary: Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address resulting in abnormal termination of the application process. Impact summary: Abnormal termination of an application can a cause a denial of service. Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address when comparing the expected name with an otherName subject alternative name of an X.509 certificate. This may result in an exception that terminates the application program. Note that basic certificate chain validation (signatures, dates, ...) is not affected, the denial of service can occur only when the application also specifies an expected DNS name, Email address or IP address. TLS servers rarely solicit client certificates, and even when they do, they generally don't perform a name check against a reference identifier (expected identity), but rather extract the presented identity after checking the certificate chain. So TLS servers are generally not affected and the severity of the issue is Moderate. The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue. Affected range <3.0.14-1~deb12u1 Fixed version 3.0.14-1~deb12u1 EPSS Score 0.04% EPSS Percentile 11th percentile Description Issue summary: Checking excessively long DSA keys or parameters may be very slow. Impact summary: Applications that use the functions EVP_PKEY_param_check() or EVP_PKEY_public_check() to check a DSA public key or DSA parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform various checks on DSA parameters. Some of those computations take a long time if the modulus (p parameter) is too large. Trying to use a very large modulus is slow and OpenSSL will not allow using public keys with a modulus which is over 10,000 bits in length for signature verification. However the key and parameter check functions do not limit the modulus size when performing the checks. An application that calls EVP_PKEY_param_check() or EVP_PKEY_public_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. These functions are not called by OpenSSL itself on untrusted DSA keys so only applications that directly call these functions may be vulnerable. Also vulnerable are the OpenSSL pkey and pkeyparam command line applications when using the -check option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue. Affected range >=3.0.11-1~deb12u2 Fixed version Not Fixed EPSS Score 0.07% EPSS Percentile 30th percentile Description OpenSSL 0.9.8i on the Gaisler Research LEON3 SoC on the Xilinx Virtex-II Pro FPGA uses a Fixed Width Exponentiation (FWE) algorithm for certain signature calculations, and does not verify the signature before providing it to a caller, which makes it easier for physically proximate attackers to determine the private key via a modified supply voltage for the microprocessor, related to a "fault-based attack." Affected range <3.0.14-1~deb12u1 Fixed version 3.0.14-1~deb12u1 Description Affected range <3.0.14-1~deb12u1 Fixed version 3.0.14-1~deb12u1 EPSS Score 0.04% EPSS Percentile 11th percentile Description Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is being used (but not if early_data support is also configured and the default anti-replay protection is in use). In this case, under certain conditions, the session cache can get into an incorrect state and it will fail to flush properly as it fills. The session cache will continue to grow in an unbounded manner. A malicious client could deliberately create the scenario for this failure to force a Denial of Service. It may also happen by accident in normal operation. This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS clients. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL 1.0.2 is also not affected by this issue.

shadow 1:4.13+dfsg1-1 (deb) pkg:deb/debian/shadow@1:4.13%2Bdfsg1-1?os_distro=bookworm&os_name=debian&os_version=12 Affected range >=1:4.13+dfsg1-1 Fixed version Not Fixed EPSS Score 0.04% EPSS Percentile 5th percentile Description shadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs are misconfigured. Specifically, this affects shadow 4.8 when compiled using --with-libpam but without explicitly passing --disable-account-tools-setuid, and without a PAM configuration suitable for use with setuid account management tools. This combination leads to account management tools (groupadd, groupdel, groupmod, useradd, userdel, usermod) that can easily be used by unprivileged local users to escalate privileges to root in multiple ways. This issue became much more relevant in approximately December 2019 when an unrelated bug was fixed (i.e., the chmod calls to suidusbins were fixed in the upstream Makefile which is now included in the release version 4.8). Affected range >=1:4.13+dfsg1-1 Fixed version Not Fixed EPSS Score 0.14% EPSS Percentile 51st percentile Description initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers.

libpcap 1.10.3-1 (deb) pkg:deb/debian/libpcap@1.10.3-1?os_distro=bookworm&os_name=debian&os_version=12 Affected range >=1.10.3-1 Fixed version Not Fixed EPSS Score 0.04% EPSS Percentile 10th percentile Description Remote packet capture support is disabled by default in libpcap. When a user builds libpcap with remote packet capture support enabled, one of the functions that become available is pcap_findalldevs_ex(). One of the function arguments can be a filesystem path, which normally means a directory with input data files. When the specified path cannot be used as a directory, the function receives NULL from opendir(), but does not check the return value and passes the NULL value to readdir(), which causes a NULL pointer derefence. Affected range >=1.10.3-1 Fixed version Not Fixed EPSS Score 0.04% EPSS Percentile 10th percentile Description In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly freeaddrinfo(), but does not clearly indicate to the caller function whether freeaddrinfo() still remains to be called after the function returns. This makes it possible in some scenarios that both the function and its caller call freeaddrinfo() for the same allocated memory block. A similar problem was reported in Apple libpcap, to which Apple assigned CVE-2023-40400.

perl 5.36.0-7+deb12u1 (deb) pkg:deb/debian/perl@5.36.0-7%2Bdeb12u1?os_distro=bookworm&os_name=debian&os_version=12 Affected range >=5.36.0-7+deb12u1 Fixed version Not Fixed EPSS Score 0.33% EPSS Percentile 71st percentile Description HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates. Affected range >=5.36.0-7+deb12u1 Fixed version Not Fixed EPSS Score 0.24% EPSS Percentile 65th percentile Description _is_safe in the File::Temp module for Perl does not properly handle symlinks.

m4 1.4.19-3 (deb) pkg:deb/debian/m4@1.4.19-3?os_distro=bookworm&os_name=debian&os_version=12 Affected range >=1.4.19-3 Fixed version Not Fixed EPSS Score 2.99% EPSS Percentile 91st percentile Description Unspecified vulnerability in GNU m4 before 1.4.11 might allow context-dependent attackers to execute arbitrary code, related to improper handling of filenames specified with the -F option. NOTE: it is not clear when this issue crosses privilege boundaries. Affected range >=1.4.19-3 Fixed version Not Fixed EPSS Score 2.12% EPSS Percentile 89th percentile Description The (1) maketemp and (2) mkstemp builtin functions in GNU m4 before 1.4.11 do not quote their output when a file is created, which might allow context-dependent attackers to trigger a macro expansion, leading to unspecified use of an incorrect filename.

krb5 1.20.1-2+deb12u2 (deb) pkg:deb/debian/krb5@1.20.1-2%2Bdeb12u2?os_distro=bookworm&os_name=debian&os_version=12 Affected range >=1.20.1-2+deb12u2 Fixed version Not Fixed EPSS Score 0.10% EPSS Percentile 41st percentile Description An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a "u4" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.

sqlite3 3.40.1-2 (deb) pkg:deb/debian/sqlite3@3.40.1-2?os_distro=bookworm&os_name=debian&os_version=12 Affected range >=3.40.1-2 Fixed version Not Fixed EPSS Score 0.22% EPSS Percentile 61st percentile Description A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made via editing the Database File), it is possible to query a record, and leak subsequent bytes of memory that extend beyond the record, which could let a malicious user obtain sensitive information. NOTE: The developer disputes this as a vulnerability stating that If you give SQLite a corrupted database file and submit a query against the database, it might read parts of the database that you did not intend or expect.

glib2.0 2.74.6-2+deb12u3 (deb) pkg:deb/debian/glib2.0@2.74.6-2%2Bdeb12u3?os_distro=bookworm&os_name=debian&os_version=12 Affected range >=2.74.6-2+deb12u3 Fixed version Not Fixed EPSS Score 0.16% EPSS Percentile 53rd percentile Description GLib 2.31.8 and earlier, when the g_str_hash function is used, computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. NOTE: this issue may be disputed by the vendor; the existence of the g_str_hash function is not a vulnerability in the library, because callers of g_hash_table_new and g_hash_table_new_full can specify an arbitrary hash function that is appropriate for the application.

gcc-12 12.2.0-14 (deb) pkg:deb/debian/gcc-12@12.2.0-14?os_distro=bookworm&os_name=debian&os_version=12 Affected range >=12.2.0-14 Fixed version Not Fixed EPSS Score 0.07% EPSS Percentile 32nd percentile Description libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.

tar 1.34+dfsg-1.2+deb12u1 (deb) pkg:deb/debian/tar@1.34%2Bdfsg-1.2%2Bdeb12u1?os_distro=bookworm&os_name=debian&os_version=12 Affected range >=1.34+dfsg-1.2+deb12u1 Fixed version Not Fixed EPSS Score 0.69% EPSS Percentile 81st percentile Description Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.

libgcrypt20 1.10.1-3 (deb) pkg:deb/debian/libgcrypt20@1.10.1-3?os_distro=bookworm&os_name=debian&os_version=12 Affected range >=1.10.1-3 Fixed version Not Fixed EPSS Score 0.19% EPSS Percentile 58th percentile Description cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation.

curl 7.88.1-10+deb12u7 (deb) pkg:deb/debian/curl@7.88.1-10%2Bdeb12u7?os_distro=bookworm&os_name=debian&os_version=12 Affected range >=7.88.1-10+deb12u7 Fixed version Not Fixed EPSS Score 0.04% EPSS Percentile 14th percentile Description libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.

nmap 7.93+dfsg1-1 (deb) pkg:deb/debian/nmap@7.93%2Bdfsg1-1?os_distro=bookworm&os_name=debian&os_version=12 Affected range >=7.93+dfsg1-1 Fixed version Not Fixed EPSS Score 2.28% EPSS Percentile 90th percentile Description Nmap through 7.70, when the -sV option is used, allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted TCP-based service.

net-tools 2.10-0.1 (deb) pkg:deb/debian/net-tools@2.10-0.1?os_distro=bookworm&os_name=debian&os_version=12 Affected range >=2.10-0.1 Fixed version Not Fixed EPSS Score 0.06% EPSS Percentile 26th percentile Description ifconfig, when used on the Linux kernel 2.2 and later, does not report when the network interface is in promiscuous mode if it was put in promiscuous mode using PACKET_MR_PROMISC, which could allow attackers to sniff the network without detection, as demonstrated using libpcap.

gnutls28 3.7.9-2+deb12u3 (deb) pkg:deb/debian/gnutls28@3.7.9-2%2Bdeb12u3?os_distro=bookworm&os_name=debian&os_version=12 Affected range >=3.7.9-2+deb12u3 Fixed version Not Fixed EPSS Score 0.85% EPSS Percentile 83rd percentile Description The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.

util-linux 2.38.1-5+deb12u1 (deb) pkg:deb/debian/util-linux@2.38.1-5%2Bdeb12u1?os_distro=bookworm&os_name=debian&os_version=12 Affected range >=2.38.1-5+deb12u1 Fixed version Not Fixed EPSS Score 0.05% EPSS Percentile 18th percentile Description A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.

coreutils 9.1-1 (deb) pkg:deb/debian/coreutils@9.1-1?os_distro=bookworm&os_name=debian&os_version=12 Affected range >=9.1-1 Fixed version Not Fixed EPSS Score 0.04% EPSS Percentile 5th percentile Description In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.

apt 2.6.1 (deb) pkg:deb/debian/apt@2.6.1?os_distro=bookworm&os_name=debian&os_version=12 Affected range >=2.6.1 Fixed version Not Fixed EPSS Score 0.16% EPSS Percentile 54th percentile Description It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.

libxml2 2.9.14+dfsg-1.3~deb12u1 (deb) pkg:deb/debian/libxml2@2.9.14%2Bdfsg-1.3~deb12u1?os_distro=bookworm&os_name=debian&os_version=12 Affected range >=2.9.14+dfsg-1.3~deb12u1 Fixed version Not Fixed EPSS Score 0.04% EPSS Percentile 11th percentile Description An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error messages with xmllint --htmlout can result in a buffer over-read in xmlHTMLPrintFileContext in xmllint.c.

gnupg2 2.2.40-1.1 (deb) pkg:deb/debian/gnupg2@2.2.40-1.1?os_distro=bookworm&os_name=debian&os_version=12 Affected range >=2.2.40-1.1 Fixed version Not Fixed EPSS Score 0.05% EPSS Percentile 18th percentile Description GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.

net-snmp 5.9.3+dfsg-2 (deb) pkg:deb/debian/net-snmp@5.9.3%2Bdfsg-2?os_distro=bookworm&os_name=debian&os_version=12 Affected range >=5.9.3+dfsg-2 Fixed version Not Fixed Description net-snmp 5.9.4 contains a memory leak vulnerability in /net-snmp/apps/snmpvacm.c.

[Kraemii]

Only a small change, for printing the error. The rest looks good to me