AlmaLinux 9.2 [TuxCare] Security Update: python3-unbound / unbound / unbound-devel / unbound-libs Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1790962865)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(362706);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/02");

  script_cve_id("CVE-2026-77955", "CVE-2026-82720", "CVE-2026-85501");
  script_xref(name:"CLSA", value:"2026:1790962865");

  script_name(english:"AlmaLinux 9.2 [TuxCare] Security Update: python3-unbound / unbound / unbound-devel / unbound-libs Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1790962865)");

  script_set_attribute(attribute:"synopsis", value:
"The AlmaLinux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare
ALMALINUX9.2:CLSA-2026:1790962865 advisory.

  - In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones
    (zonemd-check: yes) which are located below (but not at) a trust anchor allow for an attack window where
    (tampered with) zone contents are served (or stored to disk) prior to the ZONEMD integrity check. This is
    caused by the needed DS/DNSKEY asynchronous resolution that needs to happen before the ZONEMD check
    completes. If a zonefile is written to disk (zonefile: option) while the ZONEMD check failed, the tampered
    data are reloaded on startup and available until ZONEMD verification concludes again. If verification
    fails, the data is not served any more but still persists on disk for future reloads. (CVE-2026-77955)

  - NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for
    DNS-over-HTTPs support with '--with-libnghttp2'. During failure code paths (i.e., RPZ drop query, jostle
    due to heavy traffic), a dropped DoH stream brings down the whole DoH session and does not account
    properly for other DoH streams in the same session. This leads to use-after-free in those code paths. If
    the prerequisites are satisfied (possible RPZ drop or heavy client traffic), a malicious actor can trigger
    the vulnerability with a single DoH connection and the appropriate traffic. Impact is limited as the reads
    are not user controlled and the use-after-free leads to early returns. However, a hardened allocator can
    catch the use-after-free and controllably terminate the process resulting to denial of service.
    (CVE-2026-82720)

  - Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the
    term 'ReTrap'. These result in degradation of service when malicious zones are used to serve the
    algorithmic complexity vulnerabilities. NLnet Labs Unbound up to and including 1.26.0 is vulnerable to
    some of them. TagTrap, where the triple(Zone, Algo, KeyTag) matching mechanism introduces a significant
    attack vector when resolvers handle malicious responses containing numerous mismatched DNSKEY, RRSIG, and
    DS record. DelegationTrap, where constructing the chain-of-trust requires iterative validation of DNSKEY
    and DS records from the root zone downward. For deeply nested domains, this results in significant
    computational overhead. NsecTrap, where responses with excessive invalid NSEC records compel the resolver
    to validate each one. AdditionalTrap, where Unbound by default would try to DNSSEC validate the ADDITIONAL
    section as well. This can be exploited to waste validation resources by malicious users. (CVE-2026-85501)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://security.tuxcare.com/csaf/v2/els_os/almalinux9.2esu/advisories/2026/clsa-2026_1790962865.json
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?99980565");
  script_set_attribute(attribute:"see_also", value:"https://cve.tuxcare.com/els/releases/CLSA-2026:1790962865");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages based on the guidance in TuxCare advisory ALMALINUX9.2:CLSA-2026:1790962865.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-85501");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"vendor_severity", value:"Important");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/16");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/02");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/02");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Alma Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/OS/extended-third-party", "Host/local_checks_enabled", "Host/AlmaLinux/release", "Host/AlmaLinux/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (empty_or_null(third_party_support) || third_party_support != 'TuxCare') exit(0, 'TuxCare support not enabled.');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'AlmaLinux' >!< os_product) audit(AUDIT_OS_NOT, 'AlmaLinux');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'AlmaLinux');
if (! preg(pattern:"^9.2([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'AlmaLinux 9.2', 'AlmaLinux ' + os_version);

if (!get_kb_item('Host/AlmaLinux/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && cpu !~ "^i[3-6]86$" && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'AlmaLinux', cpu);


var constraints = [
  {
    'release': '9',
    'sp': '2',
    'pkgs': [
      {'reference':'python3-unbound-1.16.2-3.el9_2.tuxcare.els17', 'sp':'2', 'cpu':'aarch64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python3-unbound-1.16.2-3.el9_2.tuxcare.els17', 'sp':'2', 'cpu':'i686', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python3-unbound-1.16.2-3.el9_2.tuxcare.els17', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'unbound-1.16.2-3.el9_2.tuxcare.els17', 'sp':'2', 'cpu':'aarch64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'unbound-1.16.2-3.el9_2.tuxcare.els17', 'sp':'2', 'cpu':'i686', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'unbound-1.16.2-3.el9_2.tuxcare.els17', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'unbound-devel-1.16.2-3.el9_2.tuxcare.els17', 'sp':'2', 'cpu':'aarch64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'unbound-devel-1.16.2-3.el9_2.tuxcare.els17', 'sp':'2', 'cpu':'i686', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'unbound-devel-1.16.2-3.el9_2.tuxcare.els17', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'unbound-libs-1.16.2-3.el9_2.tuxcare.els17', 'sp':'2', 'cpu':'aarch64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'unbound-libs-1.16.2-3.el9_2.tuxcare.els17', 'sp':'2', 'cpu':'i686', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'unbound-libs-1.16.2-3.el9_2.tuxcare.els17', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'python3-unbound / unbound / unbound-devel / unbound-libs');
}