Skip to content
OpenAdvisories
High ALAS2-2020-1463 1 CVE

Important: unbound security update (Amazon Linux 2)

Published Jul 14, 2020 · Updated Jul 17, 2020

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-10772: An incomplete fix for CVE-2020-12662 was shipped for Unbound in Red Hat Enterprise Linux 7, as part of erratum RHSA-2020:2414. Vulnerable versions of Unbound could still amplify an incoming query into a large number of queries directed to a target, even with a lower amplification ratio compared to versions of Unbound that shipped before the mentioned erratum. This issue is about the incomplete fix for CVE-2020-12662, and it does not affect upstream versions of Unbound. 1846026: CVE-2020-10772 unbound: incomplete fix for CVE-2020-12662 in RHEL7

Fixed packages 5

ReleasePackageFixed in
Amazon Linux · 2 unbound 0:1.6.6-5.amzn2
Amazon Linux · 2 unbound-debuginfo 0:1.6.6-5.amzn2
Amazon Linux · 2 unbound-devel 0:1.6.6-5.amzn2
Amazon Linux · 2 unbound-libs 0:1.6.6-5.amzn2
Amazon Linux · 2 unbound-python 0:1.6.6-5.amzn2

Vulnerabilities 1

  • Unscored —
    CVE-2020-10772

    An incomplete fix for CVE-2020-12662 was shipped for Unbound in Red Hat Enterprise Linux 7, as part of erratum RHSA-202…

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-10772.html