AlmaLinux 9.6 [TuxCare] Security Update: python3-unbound / unbound / unbound-devel / unbound-dracut / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1785490706)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(359992);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/01");

  script_cve_id("CVE-2024-43167", "CVE-2026-44690", "CVE-2026-56416");
  script_xref(name:"CLSA", value:"2026:1785490706");

  script_name(english:"AlmaLinux 9.6 [TuxCare] Security Update: python3-unbound / unbound / unbound-devel / unbound-dracut / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1785490706)");

  script_set_attribute(attribute:"synopsis", value:
"The AlmaLinux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare
ALMALINUX9.6:CLSA-2026:1785490706 advisory.

  - DISPUTE NOTE: this issue does not pose a security risk as it (according to analysis by the original
    software developer, NLnet Labs) falls within the expected functionality and security controls of the
    application. Red Hat has made a claim that there is a security risk within Red Hat products. NLnet Labs
    has no further information about the claim, and suggests that affected Red Hat customers refer to
    available Red Hat documentation or support channels. ORIGINAL DESCRIPTION: A NULL pointer dereference flaw
    was found in the ub_ctx_set_fwd function in Unbound. This issue could allow an attacker who can invoke
    specific sequences of API calls to cause a segmentation fault. When certain API functions such as
    ub_ctx_set_fwd and ub_ctx_resolvconf are called in a particular order, the program attempts to read from a
    NULL pointer, leading to a crash. This issue can result in a denial of service by causing the application
    to terminate unexpectedly. (CVE-2024-43167)

  - In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field
    combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning
    that permits a malicious actor controlling a single delegated zone to poison arbitrary sibling zones under
    NSEC-signed parent domains. A malicious actor with one registered domain under an NSEC-signed TLD can
    serve malicious insecure DNS responses for unrelated sibling domains (sharing the same parent zone).
    Arbitrary delegations that do not exist under the parent domain and are covered by the parent's NSEC chain
    can be brought into insecure existence by fraudulent wildcard DS records (less labels than expected,
    unknown algorithm) from the malicious sibling domain. This allows the malicious actor to inject insecure
    wildcard records for those delegations. (CVE-2026-44690)

  - In NLnet Labs Unbound up to and including version 1.25.1, when the validator builds the canonical RDATA
    form for an RRSIG-covered PX/RP/MINFO/SOA RRset, it computes the address of the second embedded domain
    name as 'datstart + dname_valid(datstart, ...)' and passes it straight to 'query_dname_tolower()' without
    checking that a second name is actually present in the RDATA. The wire-format parser accepts multi-dname
    RRs whose RDATA ends after the first name, so an attacker who runs a DNSSEC-signed authoritative server
    can deliver a record with an absent second domain name (e.g. SOA record) and cause 'query_dname_tolower()'
    to walk label-by-label through stale bytes in the per-worker 'env->scratch_buffer', past the end of that
    heap allocation if 'msg-buffer-size' has been lowered from the default. This leads to heap buffer overflow
    and on a release build the outcome relies heavily on the contents of the buffer tail and the adjacent heap
    chunk. (CVE-2026-56416)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://security.tuxcare.com/csaf/v2/els_os/tuxcare9.6esu/advisories/2026/clsa-2026_1785490706.json
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?eb89882d");
  script_set_attribute(attribute:"see_also", value:"https://cve.tuxcare.com/els/releases/CLSA-2026:1785490706");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages based on the guidance in TuxCare advisory ALMALINUX9.6:CLSA-2026:1785490706.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-44690");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"vendor_severity", value:"Moderate");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/08/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/31");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/01");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Alma Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/OS/extended-third-party", "Host/local_checks_enabled", "Host/AlmaLinux/release", "Host/AlmaLinux/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (empty_or_null(third_party_support) || third_party_support != 'TuxCare') exit(0, 'TuxCare support not enabled.');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'AlmaLinux' >!< os_product) audit(AUDIT_OS_NOT, 'AlmaLinux');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'AlmaLinux');
if (! preg(pattern:"^9.6([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'AlmaLinux 9.6', 'AlmaLinux ' + os_version);

if (!get_kb_item('Host/AlmaLinux/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if (cpu !~ "^i[3-6]86$" && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'AlmaLinux', cpu);


var constraints = [
  {
    'release': '9',
    'sp': '6',
    'pkgs': [
      {'reference':'python3-unbound-1.16.2-19.el9_6.1.tuxcare.els11', 'sp':'6', 'cpu':'x86_64', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'unbound-1.16.2-19.el9_6.1.tuxcare.els11', 'sp':'6', 'cpu':'x86_64', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'unbound-devel-1.16.2-19.el9_6.1.tuxcare.els11', 'sp':'6', 'cpu':'i686', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'unbound-devel-1.16.2-19.el9_6.1.tuxcare.els11', 'sp':'6', 'cpu':'x86_64', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'unbound-dracut-1.16.2-19.el9_6.1.tuxcare.els11', 'sp':'6', 'cpu':'x86_64', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'unbound-libs-1.16.2-19.el9_6.1.tuxcare.els11', 'sp':'6', 'cpu':'i686', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'unbound-libs-1.16.2-19.el9_6.1.tuxcare.els11', 'sp':'6', 'cpu':'x86_64', 'el_string':'el9_6', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'python3-unbound / unbound / unbound-devel / unbound-dracut / etc');
}