unbound: integer overflow in the regional allocator via the ALIGN_UP macro
Published Apr 27, 2021
9.8
CRITICALCVSS 3.1
EPSS 1.78%
Description
Unbound before 1.9.5 allows an integer overflow in the regional allocator via the ALIGN_UP macro. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited
Affected products
No data.
Configuration 2
- 9.0
No data.
Red Hat Enterprise Linux 8
unbound-0:1.16.2-2.el8
Fixed · RHSA-2022:7622
Red Hat Enterprise Linux 8.6 Extended Update Support
unbound-0:1.7.3-17.el8_6.1
Fixed · RHSA-2024:0749
Red Hat Enterprise Linux 6
unbound
Out of support scope
Red Hat Enterprise Linux 7
unbound
Out of support scope
Red Hat Enterprise Linux 9
unbound
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 8 | unbound-0:1.16.2-2.el8 | Fixed | RHSA-2022:7622 |
| Red Hat Enterprise Linux 8.6 Extended Update Support | unbound-0:1.7.3-17.el8_6.1 | Fixed | RHSA-2024:0749 |
| Red Hat Enterprise Linux 6 | unbound | Out of support scope | n/a |
| Red Hat Enterprise Linux 7 | unbound | Out of support scope | n/a |
| Red Hat Enterprise Linux 9 | unbound | Not affected | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
There is no available reproducer or proof of concept for this issue, nor it was ever proven the buffer overflow can happen in practice. Indeed this issue was initially considered just as "side-finding", according to the original report, and for this reason its Impact is Moderate. Upstream has also disputed this CVE.
References (8)
- https://access.redhat.com/security/cve/CVE-2019-25033 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1954775 Issue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-11483 Advisory
- https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html mailing-listx_refsource_MLISTMailing ListThird Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2019-25033
- https://ostif.org/our-audit-of-unbound-dns-by-x41-d-sec-full-results/ x_refsource_MISCNot ApplicableThird Party Advisory
- https://security.netapp.com/advisory/ntap-20210507-0007/ x_refsource_CONFIRMThird Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2019-25033
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2019-25033 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1954775 | Issue Tracking | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-11483 | Advisory | |
| https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html | mailing-listx_refsource_MLISTMailing ListThird Party Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2019-25033 | ||
| https://ostif.org/our-audit-of-unbound-dns-by-x41-d-sec-full-results/ | x_refsource_MISCNot ApplicableThird Party Advisory | |
| https://security.netapp.com/advisory/ntap-20210507-0007/ | x_refsource_CONFIRMThird Party Advisory | |
| https://www.cve.org/CVERecord?id=CVE-2019-25033 |
Change history (0)
No recorded changes yet.