Debian Linux Security Advisory 1963-1 – It was discovered that Unbound, a DNS resolver, does not properly check cryptographic signatures on NSEC3 records. As a result, zones signed with the NSEC3 variant of DNSSEC lose their cryptographic protection. (An attacker would still have to carry out an ordinary cache poisoning attack to add bad data to the cache.)
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/84284/dsa-1963-1.txt
Source: https://packetstormsecurity.com/files/84284/Debian-Linux-Security-Advisory-1963-1.html