unbound: infinite loop via a compressed name in dname_pkt_copy
Published Apr 27, 2021
7.5
HIGHCVSS 3.1
EPSS 2.07%
Description
Unbound before 1.9.5 allows an infinite loop via a compressed name in dname_pkt_copy. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited
Affected products
No data.
Configuration 2
- 9.0
No data.
Red Hat Enterprise Linux 8
unbound-0:1.7.3-15.el8
Fixed · RHSA-2021:1853
Red Hat Enterprise Linux 8.2 Extended Update Support
unbound-0:1.7.3-12.el8_2
Fixed · RHSA-2022:0632
Red Hat Enterprise Linux 6
unbound
Out of support scope
Red Hat Enterprise Linux 7
unbound
Out of support scope
Red Hat Enterprise Linux 9
unbound
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 8 | unbound-0:1.7.3-15.el8 | Fixed | RHSA-2021:1853 |
| Red Hat Enterprise Linux 8.2 Extended Update Support | unbound-0:1.7.3-12.el8_2 | Fixed | RHSA-2022:0632 |
| Red Hat Enterprise Linux 6 | unbound | Out of support scope | n/a |
| Red Hat Enterprise Linux 7 | unbound | Out of support scope | n/a |
| Red Hat Enterprise Linux 9 | unbound | Not affected | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
There is no available reproducer or proof of concept for this issue, nor it was ever proven the infinite loop can be triggered in practice. Indeed in the original report this issue was considered one that might not be triggered and for this reason its Impact is Moderate. Upstream has also disputed this CVE.
References (8)
- https://access.redhat.com/security/cve/CVE-2019-25040 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1954799 Issue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-11490 Advisory
- https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html mailing-listx_refsource_MLISTMailing ListThird Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2019-25040
- https://ostif.org/our-audit-of-unbound-dns-by-x41-d-sec-full-results/ x_refsource_MISCPatchThird Party Advisory
- https://security.netapp.com/advisory/ntap-20210507-0007/ x_refsource_CONFIRMThird Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2019-25040
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2019-25040 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1954799 | Issue Tracking | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-11490 | Advisory | |
| https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html | mailing-listx_refsource_MLISTMailing ListThird Party Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2019-25040 | ||
| https://ostif.org/our-audit-of-unbound-dns-by-x41-d-sec-full-results/ | x_refsource_MISCPatchThird Party Advisory | |
| https://security.netapp.com/advisory/ntap-20210507-0007/ | x_refsource_CONFIRMThird Party Advisory | |
| https://www.cve.org/CVERecord?id=CVE-2019-25040 |
Change history (0)
No recorded changes yet.