unbound: assertion failure and denial of service in synth_cname
Published Apr 27, 2021
9.8
CRITICALCVSS 3.1
EPSS 2.07%
Description
Unbound before 1.9.5 allows an assertion failure and denial of service in synth_cname. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited
Affected products
No data.
Configuration 2
- 9.0
No data.
Red Hat Enterprise Linux 8
unbound-0:1.7.3-15.el8
Fixed · RHSA-2021:1853
Red Hat Enterprise Linux 8.2 Extended Update Support
unbound-0:1.7.3-12.el8_2
Fixed · RHSA-2022:0632
Red Hat Enterprise Linux 6
unbound
Out of support scope
Red Hat Enterprise Linux 7
unbound
Out of support scope
Red Hat Enterprise Linux 9
unbound
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 8 | unbound-0:1.7.3-15.el8 | Fixed | RHSA-2021:1853 |
| Red Hat Enterprise Linux 8.2 Extended Update Support | unbound-0:1.7.3-12.el8_2 | Fixed | RHSA-2022:0632 |
| Red Hat Enterprise Linux 6 | unbound | Out of support scope | n/a |
| Red Hat Enterprise Linux 7 | unbound | Out of support scope | n/a |
| Red Hat Enterprise Linux 9 | unbound | Not affected | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
This issue could not be triggered by running unbound regularly, but only by injecting the packet directly to the vulnerable function through fuzzing. For this reason its Impact is Moderate. Upstream has also disputed this CVE.
References (8)
- https://access.redhat.com/security/cve/CVE-2019-25036 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1954782 Issue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-11486 Advisory
- https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html mailing-listx_refsource_MLISTMailing ListThird Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2019-25036
- https://ostif.org/our-audit-of-unbound-dns-by-x41-d-sec-full-results/ x_refsource_MISCPatchThird Party Advisory
- https://security.netapp.com/advisory/ntap-20210507-0007/ x_refsource_CONFIRMThird Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2019-25036
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2019-25036 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1954782 | Issue Tracking | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-11486 | Advisory | |
| https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html | mailing-listx_refsource_MLISTMailing ListThird Party Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2019-25036 | ||
| https://ostif.org/our-audit-of-unbound-dns-by-x41-d-sec-full-results/ | x_refsource_MISCPatchThird Party Advisory | |
| https://security.netapp.com/advisory/ntap-20210507-0007/ | x_refsource_CONFIRMThird Party Advisory | |
| https://www.cve.org/CVERecord?id=CVE-2019-25036 |
Change history (0)
No recorded changes yet.
CVE.org / MITRE
CISA Vulnrichment
No data
GitHub
No data