CentOS Linux 8 [TuxCare] Security Update: python3-unbound / unbound / unbound-devel / unbound-libs Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1785489388)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(360600);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/01");

  script_cve_id("CVE-2024-43168", "CVE-2026-42923", "CVE-2026-50243");
  script_xref(name:"CLSA", value:"2026:1785489388");

  script_name(english:"CentOS Linux 8 [TuxCare] Security Update: python3-unbound / unbound / unbound-devel / unbound-libs Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1785489388)");

  script_set_attribute(attribute:"synopsis", value:
"The CentOS Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the
TuxCare CENTOS-STREAM8:CLSA-2026:1785489388 advisory.

  - DISPUTE NOTE: this issue does not pose a security risk as it (according to analysis by the original
    software developer, NLnet Labs) falls within the expected functionality and security controls of the
    application. Red Hat has made a claim that there is a security risk within Red Hat products. NLnet Labs
    has no further information about the claim, and suggests that affected Red Hat customers refer to
    available Red Hat documentation or support channels. ORIGINAL DESCRIPTION: A heap-buffer-overflow flaw was
    found in the cfg_mark_ports function within Unbound's config_file.c, which can lead to memory corruption.
    This issue could allow an attacker with local access to provide specially crafted input, potentially
    causing the application to crash or allowing arbitrary code execution. This could result in a denial of
    service or unauthorized actions on the system. (CVE-2024-43168)

  - NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the DNSSEC validator where
    the code path to consult the negative cache for DS records does not take into account the limit on NSEC3
    hash calculations introduced in 1.19.1. This leads to degradation of service during the attack. An
    adversary that controls a DNSSEC signed zone can exploit this by signing NSEC3 records with acceptably
    high iterations for child delegations and querying a vulnerable Unbound. Unbound will keep performing the
    allowed hash calculations on the NSEC3 records and will not limit the work by the mitigation introduced in
    1.19.1. As a side effect, a global lock for the negative cache will be held for the duration of the
    hashing, blocking other threads that need to consult the negative cache. Coordinated attacks could raise
    the vulnerability to denial of service. Unbound 1.25.1 contains a patch with a fix to bound the vulnerable
    code path with the existing limit for NSEC3 hash calculations. (CVE-2026-42923)

  - In NLnet Labs Unbound 1.6.2 up to and including 1.25.1, when Unbound is configured with the 'respip'
    module in front of the validator together with a 'response-ip' redirect rule or an RPZ file with an RPZ-IP
    trigger, the rewriting handler does not check the security status of the upstream answer and can instead
    rewrite a BOGUS A/AAAA answer to point to an operator's configured IP. If the validator finds an expired
    or otherwise invalid RRSIG on an answer whose A record falls within a 'response-ip'/RPZ configuration, the
    answer is still rewritten and given a hard coded security level of INSECURE. This results in the client
    receiving an INSECURE NOERROR reply rewritten by the operator's configured IP. A malicious actor can
    exploit the possible poisonous effect by spoofing a BOGUS A/AAAA answer that falls inside the operator's
    configured subnet rewrites. Such DNSSEC protected answers are then insecurely redirected to the operator's
    configured target. (CVE-2026-50243)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://security.tuxcare.com/csaf/v2/els_os/centos-stream8els/advisories/2026/clsa-2026_1785489388.json
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9769d035");
  script_set_attribute(attribute:"see_also", value:"https://cve.tuxcare.com/els/releases/CLSA-2026:1785489388");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages based on the guidance in TuxCare advisory CENTOS-STREAM8:CLSA-2026:1785489388.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:N/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-50243");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-42923");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"vendor_severity", value:"Moderate");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/08/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/31");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/01");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CentOS Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/OS/extended-third-party", "Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list");

  exit(0);
}
include('rpm2.inc');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (empty_or_null(third_party_support) || third_party_support != 'TuxCare') exit(0, 'TuxCare support not enabled.');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'CentOS Linux' >!< os_product) audit(AUDIT_OS_NOT, 'CentOS Linux');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'CentOS Linux');
if (! preg(pattern:"^8([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'CentOS Linux 8', 'CentOS Linux ' + os_version);

if (!get_kb_item('Host/CentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if (cpu !~ "^i[3-6]86$" && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'CentOS Linux', cpu);


var constraints = [
  {
    'release': '8',
    'pkgs': [
      {'reference':'python3-unbound-1.16.2-5.el8.tuxcare.els10', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'unbound-1.16.2-5.el8.tuxcare.els10', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'unbound-devel-1.16.2-5.el8.tuxcare.els10', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'unbound-devel-1.16.2-5.el8.tuxcare.els10', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'unbound-libs-1.16.2-5.el8.tuxcare.els10', 'cpu':'i686', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'unbound-libs-1.16.2-5.el8.tuxcare.els10', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_NOTE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'python3-unbound / unbound / unbound-devel / unbound-libs');
}