unbound: assertion failure via a compressed name in dname_pkt_copy
Published Apr 27, 2021
7.5
HIGHCVSS 3.1
EPSS 2.15%
Description
Unbound before 1.9.5 allows an assertion failure via a compressed name in dname_pkt_copy. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited
Affected products
No data.
Configuration 2
- 9.0
No data.
Red Hat Enterprise Linux 8
unbound-0:1.7.3-15.el8
Fixed · RHSA-2021:1853
Red Hat Enterprise Linux 8.2 Extended Update Support
unbound-0:1.7.3-12.el8_2
Fixed · RHSA-2022:0632
Red Hat Enterprise Linux 6
unbound
Out of support scope
Red Hat Enterprise Linux 7
unbound
Out of support scope
Red Hat Enterprise Linux 9
unbound
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 8 | unbound-0:1.7.3-15.el8 | Fixed | RHSA-2021:1853 |
| Red Hat Enterprise Linux 8.2 Extended Update Support | unbound-0:1.7.3-12.el8_2 | Fixed | RHSA-2022:0632 |
| Red Hat Enterprise Linux 6 | unbound | Out of support scope | n/a |
| Red Hat Enterprise Linux 7 | unbound | Out of support scope | n/a |
| Red Hat Enterprise Linux 9 | unbound | Not affected | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
According to the original report there are checks happening before the affected function that make this not exploitable. For these reasons its Impact is Moderate. Upstream has also disputed this CVE.
References (7)
- https://access.redhat.com/security/cve/CVE-2019-25041 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1954801 Issue Tracking
- https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html mailing-listx_refsource_MLISTMailing ListThird Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2019-25041
- https://ostif.org/our-audit-of-unbound-dns-by-x41-d-sec-full-results/ x_refsource_MISCPatchThird Party Advisory
- https://security.netapp.com/advisory/ntap-20210507-0007/ x_refsource_CONFIRMThird Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2019-25041
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2019-25041 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1954801 | Issue Tracking | |
| https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html | mailing-listx_refsource_MLISTMailing ListThird Party Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2019-25041 | ||
| https://ostif.org/our-audit-of-unbound-dns-by-x41-d-sec-full-results/ | x_refsource_MISCPatchThird Party Advisory | |
| https://security.netapp.com/advisory/ntap-20210507-0007/ | x_refsource_CONFIRMThird Party Advisory | |
| https://www.cve.org/CVERecord?id=CVE-2019-25041 |
Change history (0)
No recorded changes yet.