Linux Distros Unpatched Vulnerability : CVE-2026-31790

high Nessus Plugin ID 305227

Synopsis

The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.

Description

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

- Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer. Impact summary: The uninitialized buffer might contain sensitive data from the previous execution of the application process which leads to sensitive data leakage to an attacker. RSA_public_encrypt() returns the number of bytes written on success and -1 on error. The affected code tests only whether the return value is non-zero. As a result, if RSA encryption fails, encapsulation can still return success to the caller, set the output lengths, and leave the caller to use the contents of the ciphertext buffer as if a valid KEM ciphertext had been produced. If applications use EVP_PKEY_encapsulate() with RSA/RSASVE on an attacker-supplied invalid RSA public key without first validating that key, then this may cause stale or uninitialized contents of the caller- provided ciphertext buffer to be disclosed to the attacker in place of the KEM ciphertext. As a workaround calling EVP_PKEY_public_check() or EVP_PKEY_public_check_quick() before EVP_PKEY_encapsulate() will mitigate the issue. The FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.1 and 3.0 are affected by this issue.
(CVE-2026-31790)

Note that Nessus relies on the presence of the package as reported by the vendor.

Solution

There is no known solution at this time.

Plugin Details

Severity: High

ID: 305227

File Name: unpatched_CVE_2026_31790.nasl

Version: 1.3

Type: Local

Agent: unix

Family: Misc.

Published: 4/7/2026

Updated: 4/8/2026

Supported Sensors: Agentless Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.4

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2026-31790

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:U/RC:C

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:openssl-devel, cpe:/o:debian:debian_linux:11.0, cpe:/o:canonical:ubuntu_linux:24.04:-:lts, p-cpe:/a:redhat:enterprise_linux:edk2-tools, p-cpe:/a:redhat:enterprise_linux:openssl-perl, cpe:/o:canonical:ubuntu_linux:25.10, cpe:/o:redhat:enterprise_linux:9, p-cpe:/a:redhat:enterprise_linux:edk2-tools-doc, p-cpe:/a:canonical:ubuntu_linux:openssl, p-cpe:/a:redhat:enterprise_linux:edk2, cpe:/o:redhat:enterprise_linux:10, p-cpe:/a:redhat:enterprise_linux:openssl-libs, p-cpe:/a:canonical:ubuntu_linux:edk2, p-cpe:/a:debian:debian_linux:openssl, p-cpe:/a:redhat:enterprise_linux:edk2-ovmf, p-cpe:/a:redhat:enterprise_linux:openssl, cpe:/o:canonical:ubuntu_linux:22.04:-:lts, cpe:/o:debian:debian_linux:14.0, p-cpe:/a:redhat:enterprise_linux:edk2-aarch64

Required KB Items: Host/cpu, Host/local_checks_enabled, global_settings/vendor_unpatched, Host/OS/identifier

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 4/7/2026

Reference Information

CVE: CVE-2026-31790

Detections

Analytics