Debian DSA-6507：libunbound-dev - 安全更新
critical Nessus 插件 ID 348572
语言：
简介
远程 Debian 主机上缺少一个或多个与安全性相关的更新。描述
远程 Debian 13 主机上存在安装的程序包，该程序包受到 dsa-6507 公告中提及的多个漏洞的影响。------------------------------------------------------------------------- Debian 安全公告 [email protected] DSA-6507-1https://www.debian.org/security/Moritz Muehlenhoff 2026 年 9 月 19 日 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
程序包：unbound CVE ID： CVE-2026-14586 CVE-2026-32665 CVE-2026-40622 CVE-2026-40691 CVE-2026-41637 CVE-2026-42955 CVE-2026-44621 CVE-2026-44687 CVE-2026-44690 CVE-2026-46582 CVE-2026-50045 CVE-2026-50046 CVE-2026-50243 CVE-2026-50248 CVE-2026-50251 CVE-2026-50252 CVE-2026-52863 CVE-2026-54478 CVE-2026-55708 CVE-2026-55717 CVE-2026-55973 CVE-2026-55990 CVE-2026-55991 CVE-2026-56416 CVE-2026-56444 CVE-2026-77860 CVE-2026-77955 CVE-2026-78227 CVE-2026-80225 CVE-2026-81634 CVE-2026-81642 CVE-2026-82717 CVE-2026-82720 CVE-2026-85501
验证、递归、缓存 DNS 解析器 Unbound 中发现多个安全漏洞，可能会造成拒绝服务、缓存中毒、DNS cookie 绕过，或可能会造成执行任意代码。
对于稳定发行版本 （trixie），已在版本 1.26.1-0+deb13u1 中修复这些问题。
建议您升级 unbound 程序包。
如需了解 unbound 的详细安全状态，请参阅其安全跟踪页面：
https://security-tracker.debian.org/tracker/unbound
有关 Debian 安全公告、如何将这些更新应用到系统以及常见问题解答的更多信息，请访问以下网址：https://www.debian.org/security/
邮件列表：[email protected]
Tenable 已直接从 Debian 安全公告中提取上述描述块。
请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。
解决方案
升级 libunbound-dev 程序包。另见
https://packages.debian.org/source/trixie/unbound
https://security-tracker.debian.org/tracker/CVE-2026-14586
https://security-tracker.debian.org/tracker/CVE-2026-32665
https://security-tracker.debian.org/tracker/CVE-2026-40622
https://security-tracker.debian.org/tracker/CVE-2026-40691
https://security-tracker.debian.org/tracker/CVE-2026-41637
https://security-tracker.debian.org/tracker/CVE-2026-42955
https://security-tracker.debian.org/tracker/CVE-2026-44621
https://security-tracker.debian.org/tracker/CVE-2026-44687
https://security-tracker.debian.org/tracker/CVE-2026-44690
https://security-tracker.debian.org/tracker/CVE-2026-46582
https://security-tracker.debian.org/tracker/CVE-2026-50045
https://security-tracker.debian.org/tracker/CVE-2026-50046
https://security-tracker.debian.org/tracker/CVE-2026-50243
https://security-tracker.debian.org/tracker/CVE-2026-50248
https://security-tracker.debian.org/tracker/CVE-2026-50251
https://security-tracker.debian.org/tracker/CVE-2026-50252
https://security-tracker.debian.org/tracker/CVE-2026-52863
https://security-tracker.debian.org/tracker/CVE-2026-54478
https://security-tracker.debian.org/tracker/CVE-2026-55708
https://security-tracker.debian.org/tracker/CVE-2026-55717
https://security-tracker.debian.org/tracker/CVE-2026-55973
https://security-tracker.debian.org/tracker/CVE-2026-55990
https://security-tracker.debian.org/tracker/CVE-2026-55991
https://security-tracker.debian.org/tracker/CVE-2026-56416
https://security-tracker.debian.org/tracker/CVE-2026-56444
https://security-tracker.debian.org/tracker/CVE-2026-77860
https://security-tracker.debian.org/tracker/CVE-2026-77955
https://security-tracker.debian.org/tracker/CVE-2026-78227
https://security-tracker.debian.org/tracker/CVE-2026-80225
https://security-tracker.debian.org/tracker/CVE-2026-81634
https://security-tracker.debian.org/tracker/CVE-2026-81642
https://security-tracker.debian.org/tracker/CVE-2026-82717
https://security-tracker.debian.org/tracker/CVE-2026-82720
https://security-tracker.debian.org/tracker/CVE-2026-85501
https://security-tracker.debian.org/tracker/source-package/unbound
插件详情
严重性: Critical
ID: 348572
文件名: debian_DSA-6507.nasl
版本: 1.1
类型: Local
代理: unix
发布时间: 2026/9/21
最近更新时间: 2026/9/21
支持的传感器: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus
风险信息
VPR
风险因素: High
分数: 7.6
百分位: 98.3
CVSS v2
风险因素: High
基本分数: 7.8
时间分数: 5.8
矢量: CVSS2#AV:A/AC:L/Au:N/C:N/I:C/A:C
CVSS 分数来源: CVE-2026-50252
CVSS v3
风险因素: Critical
基本分数: 9.3
时间分数: 8.1
矢量: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
时间矢量: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
风险因素: Critical
Base Score: 10
Threat Score: 9.1
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVSS 分数来源: CVE-2026-81642
漏洞信息
CPE: cpe:/o:debian:debian_linux:13.0, p-cpe:/a:debian:debian_linux:libunbound-dev, p-cpe:/a:debian:debian_linux:libunbound8, p-cpe:/a:debian:debian_linux:python3-unbound, p-cpe:/a:debian:debian_linux:unbound-anchor, p-cpe:/a:debian:debian_linux:unbound-host, p-cpe:/a:debian:debian_linux:unbound
必需的 KB 项: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l
易利用性: No known exploits are available
补丁发布日期: 2026/9/19
漏洞发布日期: 2026/5/20
参考资料信息
CVE: CVE-2026-14586, CVE-2026-32665, CVE-2026-40622, CVE-2026-40691, CVE-2026-41637, CVE-2026-42955, CVE-2026-44621, CVE-2026-44687, CVE-2026-44690, CVE-2026-46582, CVE-2026-50045, CVE-2026-50046, CVE-2026-50243, CVE-2026-50248, CVE-2026-50251, CVE-2026-50252, CVE-2026-52863, CVE-2026-54478, CVE-2026-55708, CVE-2026-55717, CVE-2026-55973, CVE-2026-55990, CVE-2026-55991, CVE-2026-56416, CVE-2026-56444, CVE-2026-77860, CVE-2026-77955, CVE-2026-78227, CVE-2026-80225, CVE-2026-81634, CVE-2026-81642, CVE-2026-82717, CVE-2026-82720, CVE-2026-85501